CZ Warns on Critical PHP Vulnerability as Exploits Hit

PHP maintainers patched two unauthenticated remote code execution flaws on October 21, 2026. Both carry a 9.2 Critical rating from the PHP Group, and security teams say attackers are already probing exposed servers.

What the Critical PHP Vulnerability Actually Does

The two bugs sit in the PHP runtime itself, not in any plugin or app. So any unpatched server that answers web requests is potentially exposed, no matter what code runs on top.

The first flaw, CVE-2026-109618, is a use-after-free tied to out-of-memory handling. PHP aborts a request when memory runs out, and a failed allocation can leave request memory in a broken state. Later cleanup then reads that memory and opens the door to remote code execution.

The second flaw, CVE-2026-109619, involves stale global state. A worker can hold on to error, session, or object state that still points into freed memory. As a result, the next request on that same worker can trip over the stale data before normal setup runs.

Both flaws let an attacker run code as the PHP worker with no login. Both can also leak memory in a Heartbleed style, so passwords, tokens, and API keys may spill. Researchers even demonstrated full control on Apache mod_php before any application code ran.

The PHP Group scored both bugs at 9.2 on the CVSS 4.0 scale, which lands firmly in Critical territory. Some vendor notes list different CVSS 3.1 figures, and an early leaked claim of a perfect 10 was simply wrong. Still, the Attack Complexity rates as High, so reliable exploits can depend on server setup.

Why CZ Told Crypto Users to Be Careful

CZ posted his warning on X at 22:06 UTC on October 21, 2026. In it, he flagged both CVEs by number and named WordPress and Magento as examples of affected apps.

His point was about visiting sites, not just running them. Attackers can turn a popular site into a weapon. A compromised page could then serve fake login prompts or wallet-drainer scripts to visitors. That stays true even when your own site is fully patched.

“Call me paranoid, but be extra careful visiting ANY web site in the next few days,” CZ wrote. He closed, as he often does, with “Stay SAFU!”

The framing looks precautionary rather than tied to a specific breach. Still, several crypto projects moved quickly to reassure users. BNB Chain, PancakeSwap, Coinbase, and BitGo each said their stacks are not exposed to the flaws.

Which PHP Versions Are Affected

The fixes highlighted in the CZ PHP warning landed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Anyone running an earlier release within those branches should update immediately.

Older versions dating back to PHP 5.4 contain at least one of the bugs. Source backports are available for PHP 7.4, 8.0, and 8.1, but no packaged releases were issued for those end-of-life branches. PHP’s widespread use makes unpatched installations a significant concern.

Apache mod_php carries the highest risk, since researchers proved reliable exploitation there. PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed also look affected or likely vulnerable, depending on the setup. The PHP team put it plainly in its advisory: “There are no complete mitigations, updating is the only safe choice.”

How the Flaws Were Found and Leaked

Researchers at Calif.io, Wiz Research, and OpenAI independently discovered the bugs in August 2026. OpenAI used AI-assisted research, marking a notable milestone for the approach.

The vulnerabilities behind the CZ PHP warning were scheduled for coordinated disclosure on October 22. However, a Hacker News post leaked the embargoed flaws around 15:20 UTC on October 20. PHP accelerated its release, publishing GitHub advisories and patches on October 21.

The PHP Foundation also acknowledged an earlier failure. A 2024 audit had flagged a related out-of-memory issue, but remediation stalled. The foundation called the delay a “structural failure,” citing weaknesses in its security process and insufficient resources.

What Crypto Users Should Do Now

Site operators should act on the CZ PHP warning by installing the fixed PHP releases today, prioritizing Apache mod_php hosts. Partial workarounds, such as disabling session upload progress, remain incomplete, making updating essential.

Everyday users should treat login prompts and wallet-connect requests on unfamiliar sites with extra care and double-check transactions before signing. According to Cloudflare and other trackers, early attack traffic appeared soon after disclosure. However, the full scale of successful compromises remains unknown.

For now, the CZ PHP warning reinforces a simple message: patch fast, stay alert, and verify before you click. This article is not financial advice. Faster patching will help narrow the window of risk.