Changpeng Zhao (CZ) urged users to be particularly cautious for several days after technical details about two critical PHP vulnerabilities patched on October 21 were disclosed early. Identified as CVE-2026-109618 and CVE-2026-109619, they can be exploited without authentication and turn a website merely visited into a vector for credential theft or device compromise. The NSA, FBI, and Cloudflare recommended updates or taking vulnerable systems offline, while active exploitation was confirmed shortly after disclosure. BNB Chain and PancakeSwap said they do not use PHP in their infrastructures, with PancakeSwap confirming that user funds were safe.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
