🛡️ Overnight, crypto projects were all shouting, “We don’t use PHP”
After the two critical PHP vulnerabilities rated 9.2 (CVE-2026-109618/109619, dubbed “php2shell” in the community) started gaining traction, a wave of public statements appeared on X today.
🔹 PancakeSwap spoke up first: its tech stack doesn’t use PHP, and users’ funds are safe
🔹 CZ then suggested that every project publicly clarify whether it was affected
🔹 Nina Rong from BNB Chain posted that BNB Chain’s tech stack doesn’t use PHP
🔹 Then a whole bunch of projects—and even plenty of meme coin accounts—followed suit, posting, “Our contracts run on BNB Chain, not PHP”
I think CZ’s suggestion is a good one. As one person put it well: during the week something goes wrong, the last thing you want is for project teams to stay silent. Silence can trigger panic withdrawals and give fake “customer support” accounts an opening. It costs very little to clearly state what you use and whether you’re affected.
But as a user, you should also understand the limits of these statements:
“Doesn’t use PHP” only means this particular vulnerability is irrelevant to the project. It doesn’t mean the project has no other risks. Smart contracts aren’t written in PHP to begin with, so meme coins jumping on this for attention are providing virtually no information. What you should really care about is whether the frontend website, backend, or third-party services have been tampered with.
My approach is simple: trust statements only from official accounts; verify contract addresses before interacting; reject any unfamiliar authorization requests; and block anyone who messages you claiming to be “official support.”
Which projects you use haven’t commented on this yet? Let us know in the comments 👇
#PHP漏洞 #BNBChain #币圈安全 #CZ
After the two critical PHP vulnerabilities rated 9.2 (CVE-2026-109618/109619, dubbed “php2shell” in the community) started gaining traction, a wave of public statements appeared on X today.
🔹 PancakeSwap spoke up first: its tech stack doesn’t use PHP, and users’ funds are safe
🔹 CZ then suggested that every project publicly clarify whether it was affected
🔹 Nina Rong from BNB Chain posted that BNB Chain’s tech stack doesn’t use PHP
🔹 Then a whole bunch of projects—and even plenty of meme coin accounts—followed suit, posting, “Our contracts run on BNB Chain, not PHP”
I think CZ’s suggestion is a good one. As one person put it well: during the week something goes wrong, the last thing you want is for project teams to stay silent. Silence can trigger panic withdrawals and give fake “customer support” accounts an opening. It costs very little to clearly state what you use and whether you’re affected.
But as a user, you should also understand the limits of these statements:
“Doesn’t use PHP” only means this particular vulnerability is irrelevant to the project. It doesn’t mean the project has no other risks. Smart contracts aren’t written in PHP to begin with, so meme coins jumping on this for attention are providing virtually no information. What you should really care about is whether the frontend website, backend, or third-party services have been tampered with.
My approach is simple: trust statements only from official accounts; verify contract addresses before interacting; reject any unfamiliar authorization requests; and block anyone who messages you claiming to be “official support.”
Which projects you use haven’t commented on this yet? Let us know in the comments 👇
#PHP漏洞 #BNBChain #币圈安全 #CZ