PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO

Internet users are still vulnerable to cyber exploits stemming from the PHP vulnerability, particularly through smaller websites that could take weeks to adopt the upgrade shipped last Wednesday,  according to bug bounty platform Immunefi CEO Mitchell Amador.

“This is the vulnerability apocalypse” running on schedule, where finding vulnerabilities became cheap, but fixing them remains expensive, Amador told Cointelegraph.

“For the next few weeks, treat any site you log into as if it could already be compromised,” said Amador, warning users to avoid reusing passwords and to exercise caution when connecting their cryptocurrency wallets to websites. He also urged users to revoke unrecognized token approvals.

The comments come nearly a week after the PHP Foundation acknowledged that it delayed fixing a critical security flaw first identified in 2024, due to a shortage of resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but websites still need to independently upgrade.

In an interview published by Cointelegraph in June, Amador warned that the proliferation of frontier AI models changed the cybersecurity playing field in favor of attackers, causing a “vulnerability apocalypse” that led to the resurgence in decentralized finance (DeFi) hacks.