CZ Alert: Two Critical PHP Vulnerabilities Disclosed; Remain Vigilant When Visiting Websites in the Coming Days

CZ (@cz_binance) posted on X that PHP recently disclosed two vulnerabilities (CVE-2026-109618 and CVE-2026-109619), affecting servers running applications like WordPress and Magento. The relevant patch was released on October 21, but vulnerability details were leaked prematurely, and active exploitation in the wild has been confirmed. CZ warned users that some website administrators may not have updated security patches promptly, making compromised sites potential entry points for credential theft or device attacks. Extreme caution is advised when visiting any website over the next few days. Previously, PHP was reported to have a critical security vulnerability, leading to mass outages of government websites across multiple European countries.