Binance founder CZ is warning internet users to be cautious online after researchers found two critical PHP vulnerabilities under active exploitation. The flaws could affect up to 70 percent of websites, including platforms like WordPress and Magento, making this one of the biggest security events of the year for crypto and the wider internet alike.
What actually happened
CZ, founder of Binance, posted a warning on 23 October 2026 urging caution when visiting websites in the coming days. He said PHP, used widely for WordPress and Magento, fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on 21 October 2026. Details leaked before the official disclosure, and exploitation began almost immediately. Amazon's threat intelligence team detected exploitation attempts as early as 17 October 2026, days before the public fix. Palo Alto Networks counted more than 22.6 million exposed instances worldwide. Wiz researchers estimated the flaws could affect roughly 70 percent of the internet, calling the underlying issue more than a decade old. Matt Hull of NCC Group warned some systems may already be compromised and backdoored, according to WuBlockchain.
How we got here
Dragonfly managing partner Haseeb Qureshi said crypto is experiencing a hacking wave first, ahead of the broader internet, because on-chain attacks are easiest to monetize directly. He noted attack volume has risen sharply, but annualized losses are roughly flat versus 2025, meaning average losses per incident have fallen as large protocols adopt AI defenses. Ethereum co-founder Vitalik Buterin, responding to debate over AI-assisted vulnerability discovery, said he never expected defense to automatically outpace attackers. He argued lasting advantages require deeper changes, including formal verification, and urged spending over 1 percent of GDP on cybersecurity and biosecurity, per WuBlockchain.
Why this matters for you
For crypto users, this is a reminder that most hacks still start with ordinary web infrastructure, not smart contracts. Wallet interfaces, exchange portals and DeFi front ends often run on PHP based systems, so unpatched servers can expose credentials or seed phrases. Builders running small protocols face the highest risk, since Qureshi says attackers increasingly target projects with weak security budgets. Larger platforms adding AI powered monitoring may see fewer losses per incident, but smaller teams cannot yet match that. Anyone managing a personal site, wallet gateway or company blog should confirm the 21 October patch is installed and treat outdated plugins as an active threat, not a future one.
The bigger question
If AI can help attackers and defenders discover the same flaws at the same speed, does better detection actually reduce real world harm, or does it only accelerate how fast both sides move? Buterin's own uncertainty about whether defense can get ahead suggests even experts do not know who benefits most as these tools spread across crypto and the wider internet.
What to watch
Security teams will keep tracking exploitation of CVE-2026-109618 and CVE-2026-109619 through the rest of 2026. Website operators should confirm the 21 October patch is applied immediately. Separately, the OCC's first GENIUS Act rule on stablecoin yields takes effect 18 January 2027, a reminder that crypto's security and regulatory timelines are now moving in parallel.
