Odaily Planet Daily lays out the timeline clearly: CZ warned on X that two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were not patched until October 21, but details had already leaked before the patches were released. Not long after the leak, confirmed cases of exploitation had already emerged. Attackers don’t need to authenticate: they can use affected websites to steal visitors’ credentials or target their devices. Servers running WordPress and Magento are also affected. The relevant IT teams are deploying web application firewalls and installing patches. I can’t tie this to positions or funding rates on my end—the key issue is credentials. In the coming days, clicking around on websites carelessly could put your login details at risk first. CZ said to be extra careful when visiting any website over the next few days, and I’m taking that advice.
#安全提醒 #加密快讯