Bollcoin reported on October 22 that Binance founder Changpeng Zhao (CZ) posted on X that two vulnerabilities have been disclosed in PHP (CVE-2026-109618, CVE-2026-109619), affecting servers running applications such as WordPress and Magento. The vulnerability details were leaked before the patch was released, and the patch was released on October 21. Confirmed cases of exploitation emerged shortly after the leak. Attackers can turn affected websites into tools for stealing visitors' credentials or attacking their devices without authentication. IT teams are deploying WAF (Web Application Firewall) protection and installing patches. CZ reminded users to be extra careful when visiting any website in the coming days.