Binance founder Changpeng Zhao (CZ) issued a warning to users about two high-severity vulnerabilities (CVE-2026-109618 and CVE-2026-109619) discovered in the PHP programming language. These vulnerabilities affect servers running popular applications such as WordPress and Magento. Although patches were released on October 21, 2026, details of the vulnerabilities were leaked prematurely, and in-the-wild exploitation was soon confirmed. He advised users to be extra cautious when visiting any website in the coming days, as some website administrators may not have updated security patches in time, and unverified attacks could lead to credential theft or device exploitation.