CZ: PHP vulnerabilities have already been exploited in the wild, urging users to be cautious when visiting websites in the coming days

Odaily reports: Binance founder CZ posted a warning on X that PHP recently disclosed two security vulnerabilities (CVE-2026-109618, CVE-2026-109619), which may affect servers running applications such as WordPress and Magento.

CZ stated that details of the vulnerabilities were leaked before the patch was released, and the patch was released on October 21. Shortly after the vulnerability information leaked, confirmed cases of exploitation emerged. Attackers can exploit affected websites without authentication to steal visitors' credentials or launch attacks against their devices.

Currently, relevant IT teams are deploying Web Application Firewall (WAF) protection and installing patches. CZ reminds users to be extra cautious when visiting any website in the coming days.