Key Insights Crypto news includes a warning from Binance founder Changpeng Zhao over two critical PHP vulnerabilities. PHP developers advanced security patches to October 21 after vulnerabili
Crypto news drew attention to website security after Binance founder Changpeng Zhao warned users about two critical PHP vulnerabilities. On October 22, he urged caution when browsing over the coming days.
The flaws could let attackers execute code on vulnerable servers without authentication. Affected installations support platforms including WordPress, Magento, Drupal, and Joomla.
Developers released emergency patches on October 21 after information leaked before the planned disclosure. Researchers have detected exploitation attempts, while some administrators may still need to update their systems. No confirmed incidents involving cryptocurrency exchanges or user wallets have been directly linked to the newly disclosed vulnerabilities.
Changpeng Zhao tied his crypto news warning to website administrators who might not have installed the latest security updates. His warning concerned websites that attackers could compromise through vulnerable PHP installations.
Crypto News: CZ Urges Caution After Critical PHP Flaws Emerge | Source: X
PHP runs on millions of websites worldwide. The vulnerabilities affect server infrastructure, which attackers could use to access sensitive information or modify content.
For crypto news readers, the distinction concerns where an attack starts. Visiting a PHP website does not automatically compromise a device or cryptocurrency wallet.
However, attackers controlling a server could alter login pages or introduce fraudulent wallet connection requests. The resulting exposure would depend on the access they obtained.
The Binance founder issued his warning against a backdrop of phishing campaigns targeting cryptocurrency users. Previous reports described fake Ledger websites seeking recovery phrases and Trezor phishing emails distributed through compromised infrastructure.
Neither incident establishes a connection to the newly disclosed PHP flaws.
The PHP Foundation identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Both received severity scores of 9.2 out of 10.
The first involves memory corruption when PHP reaches its configured memory limit during certain operations. Under specific conditions, incorrect handling of partially initialized data could permit unauthorized code execution.
The second involves internal references remaining accessible after PHP releases the associated memory. Researchers demonstrated code execution against applications running on affected servers.
The foundation confirmed exploitation under default Apache configurations using mod_php. Researchers also demonstrated attack paths involving PHP-FPM.
Developers released PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21. The official advisory urged immediate updates because temporary protections could not fully remove the risk.
Unsupported PHP branches may depend on separate fixes from hosting providers or software vendors.
The vulnerability identifiers appeared on forums and social media on October 20. Those posts carried an incorrect 10.0 severity score and an inaccurate release schedule.
The initial leak contained no technical exploit instructions. The crypto news warning followed a disclosure process disrupted by further material circulating online.
Security company Calif subsequently published a proof-of-concept video by mistake. Copies circulated after its removal, and researchers developed additional exploit demonstrations.
The PHP team advanced its scheduled October 22 release by one day. This gave software distributors time to prepare updates while limiting the period when technical details circulated without available patches. The foundation also criticized Chainguard for releasing patched software images over six hours before coordinated disclosure.
It said attackers could examine those changes before the public announcement. Cloudflare deployed firewall protections before disclosure, working alongside researchers from OpenAI, Wiz, and other organizations.
Cloudflare called the vulnerabilities PHP2Shell and identified risks including remote code execution, service disruption, and sensitive data exposure.
The Canadian Centre for Cyber Security urged organizations running internet-facing PHP applications to identify vulnerable installations and apply available updates.
The post Crypto News: CZ Warns Website Patch Delays Could Leave Crypto Users Exposed appeared first on The Coin Republic.
