CZ issued a warning today: be careful when visiting any website over the next few days. The reason isn’t that any blockchain was hacked—it’s that details of two PHP remote code execution vulnerabilities (CVE-2026-109618 / CVE-2026-109619) leaked ahead of time. Patches weren’t released until October 21, and exploitation in the wild was subsequently confirmed.

This has nothing to do with smart contracts or cold wallets. The risk lies in PHP-powered website front ends, login pages, KYC systems, and similar services—visiting an unpatched site could lead you straight into a credential-stealing trap.

$CAKE’s PancakeSwap was quick to clarify: its tech stack doesn’t use PHP at all, so the platform is unaffected and funds are safe. BNB Chain also confirmed that its network and core infrastructure don’t use PHP and aren’t affected by PHP2Shell. CZ reposted PancakeSwap’s statement, saying that most projects should at least put out a quick confirmation.

Screening takeaway: First check whether the project has said “we don’t use PHP / we’ve already patched it.” Don’t automatically assume a web-layer vulnerability means its on-chain funds were drained.

This is not investment advice.

#PHP #BNBChain #PancakeSwap #安全 #Web3