A cybersecurity organisation under the U.S. National Security Agency has warned of a major vulnerability in PHP, and BNB Chain and PancakeSwap said their services are not affected. Binance founder Changpeng Zhao (CZ) also said projects should quickly disclose their security positions, stressing the importance of communicating with users.

On Oct. 22 local time, blockchain outlet U.Today reported that BNB Chain and PancakeSwap posted notices saying they do not use PHP in their technology stacks and are therefore not affected by the vulnerability.

The warning applies to systems that use PHP. PHP is a programming language widely used to develop websites and web applications. If exploited, the vulnerability could open a path for attackers to access a server file system, making security updates and checks important for related systems.

As the warning spread, BNB Chain explained its relevance to the issue. Nina Rong of BNB Chain said it does not use PHP in its technology stack and urged users to pay attention to safety. The company sought to address users' concerns by making clear it does not use the affected technology.

PancakeSwap had earlier issued a similar position. It said it does not use PHP anywhere in its technology stack, that the platform is not affected by the issue and that user funds are safe.

As major decentralised exchanges and blockchain projects in the BNB Chain ecosystem successively released statements, attention shifted to whether individual services were actually exposed to the vulnerability.

CZ shared PancakeSwap's notice and stressed that other projects should post similar confirmation messages. His point was that when a security warning occurs, if users cannot tell whether related services are responding, anxiety can grow and unnecessary speculation can spread.

Cryptocurrency services are inevitably sensitive to security issues because they are directly linked to users' funds through trading and asset custody. Beyond the severity of the vulnerability itself, clearly conveying whether a project is exposed to risk and what measures it is taking is also an important factor in maintaining trust.

Still, a notice that a specific service does not use PHP does not eliminate all security risks. Core blockchain software and surrounding systems such as websites, wallet interfaces and dashboards can be built on different technologies. Each project should therefore check whether it is exposed to the vulnerability based on its actual operating environment.

Users also need to watch for phishing and scams that exploit security warnings. Fake notices and links claiming emergency patches or fund protection can be circulated, so it is advisable to verify guidance through a project's official channels.

The case showed that swift and transparent notices, along with technical responses to security warnings, play an important role in protecting user trust. Still, the actual level of risk can differ by service depending on the technologies used and operating environments, making individual checks necessary.

Most projects should at least post a confirmation like this.