PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO

Internet users are still vulnerable to cyber exploits stemming from the PHP vulnerability, particularly through smaller websites that could take weeks to adopt the upgrade shipped last Wednesday,  according to bug bounty platform Immunefi CEO Mitchell Amador.

“This is the vulnerability apocalypse” running on schedule, where finding vulnerabilities became cheap, but fixing them remains expensive, Amador told Cointelegraph.

“For the next few weeks, treat any site you log into as if it could already be compromised,” said Amador, warning users to avoid reusing passwords and to exercise caution when connecting their cryptocurrency wallets to websites. He also urged users to revoke unrecognized token approvals.

The comments come nearly a week after the PHP Foundation acknowledged that it delayed fixing a critical security flaw first identified in 2024, due to a shortage of resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but websites still need to independently upgrade.

In an interview published by Cointelegraph in June, Amador warned that the proliferation of frontier AI models changed the cybersecurity playing field in favor of attackers, causing a “vulnerability apocalypse” that led to the resurgence in decentralized finance (DeFi) hacks.

Percentage of programs with a confirmed critical vulnerability by time live.
Source: Immunefi

Immunefi is the world’s largest bug bounty platform that paid out $140 million in bounties across 650 protocols to date, according to its homepage.

Related: Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash

PHP flaw drew millions of exploit attempts within hours

According to Cloudflare’s CEO Matthew Prince, the network saw millions of exploit attempts in the 24 hours after the PHP vulnerabilities were publicly revealed and thousands of attempts even before their disclosure, he wrote a Thursday X post.

About one in five websites worldwide routes traffic through Cloudflare, according to the internet infrastructure company, which helps websites load faster and protect users from cyber threats.

Research service W3Techs estimates that PHP powers about 69% of websites with a known server-side programming language. The vulnerabilities may allow attackers to spread malware or inject malicious scripts into websites around the world.

The FBI’s Cyber Division also warned that the vulnerabilities may allow malicious actors to “remotely execute code in PHP core, potentially compromising sensitive data and networks,” according to a Wednesday X post.