Binance founder Changpeng Zhao (CZ) warned users to exercise caution when visiting websites over the coming days, citing two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting servers running popular applications such as WordPress and Magento. The flaws, patched on October 21 after details leaked ahead of disclosure, could allow unauthenticated attackers to execute malicious code on vulnerable servers, potentially exposing visitors to credential theft. Exploitation attempts have already been detected, while some website operators may not yet have applied security updates.