PHP Security Flaw Puts 70% of Web at Risk, CZ Warns
Binance founder Changpeng Zhao is telling internet users to stay alert after two serious PHP bugs were found being actively exploited. The flaws sit inside software running a huge share of the web, including many wallet interfaces and exchange portals, so this is not just a developer problem.
What actually happened
CZ posted his warning on 23 October 2026, days after PHP patched two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on 21 October 2026. Details leaked ahead of the official fix, and attackers moved fast. Amazon's threat intelligence team spotted exploitation attempts as early as 17 October 2026, before the patch existed. Palo Alto Networks counted more than 22.6 million exposed systems worldwide. Wiz researchers estimated the underlying bug, over a decade old, touches roughly 70 percent of the internet, including WordPress and Magento sites. NCC Group's Matt Hull warned some systems may already carry hidden backdoors, according to Wu Blockchain.
How we got here
Crypto security researchers have flagged this pattern before. Dragonfly's Haseeb Qureshi says crypto gets hit by hacking waves earlier than the rest of the internet, because stolen crypto is easy to cash out fast. He notes attack numbers are climbing, yet yearly losses stay close to 2025 levels, since big platforms now lean on AI tools to catch intrusions sooner. Ethereum co-founder Vitalik Buterin pushed back on hopes that AI defense would simply outrun AI-assisted attacks. He argued real protection needs structural fixes, like formal verification, and called for spending over 1 percent of GDP on cybersecurity and biosecurity combined, per Wu Blockchain.
Why this matters for you
For everyday wallet users, this matters because many exchange portals, DeFi front ends and even wallet login pages still run on PHP. A compromised server could quietly harvest passwords or seed phrases before anyone notices. Smaller apps and independent projects face the biggest exposure, since Qureshi says attackers now chase teams with thin security budgets. Bonuz and similar app ecosystems built around everyday crypto use are a reminder of why checking site patches matters, not just checking wallet balances. If you run a personal site, store, or gateway on PHP, confirm the 21 October patch is live and treat old plugins as a real risk today.
The bigger question
If AI tools help both attackers and defenders find the same flaws at similar speed, does that actually make users safer, or does it just speed up the race between them? Buterin's own doubt about whether defense can truly pull ahead suggests nobody, including security experts, is certain who gains more as these tools spread through crypto and the wider internet.
What to watch
Security teams will keep tracking exploitation of CVE-2026-109618 and CVE-2026-109619 through the rest of 2026. Anyone running a PHP based site should confirm the 21 October patch immediately. Separately, the OCC's first GENIUS Act rule on stablecoin yields takes effect 18 January 2027, a sign that crypto's security and regulatory calendars are now running side by side.
