Immunefi CEO Mitchell Amador warns that internet users remain at risk from a critical PHP security flaw. While emergency patches were released last Wednesday, smaller websites may take weeks to implement the necessary upgrades, leaving them potentially compromised in the interim.
Amador describes the situation as a vulnerability apocalypse, noting that while identifying security flaws has become inexpensive, the cost of remediation remains high. He advises users to avoid password reuse and exercise caution when connecting cryptocurrency wallets to websites, specifically recommending the revocation of unrecognized token approvals.
The PHP Foundation acknowledged that resource shortages delayed the resolution of a critical flaw initially identified in 2024. Cloudflare CEO Matthew Prince reported millions of exploit attempts within 24 hours of the public disclosure, with thousands of attempts occurring even prior to the announcement.
Data from W3Techs indicates that PHP powers approximately 69% of websites using a known server-side language. The FBI’s Cyber Division has cautioned that these vulnerabilities could enable malicious actors to execute code remotely in the PHP core, potentially leading to the compromise of sensitive data and networks.
