ChainCatcher report: Mitchell Amador, CEO of the bug bounty platform Immunefi, warned that internet users remain at risk of cyberattacks triggered by PHP vulnerabilities, particularly affecting smaller websites that are slow to implement emergency patches—some of which may take weeks to remediate. He stated that “bug apocalypse” is unfolding as planned: the cost of discovering vulnerabilities has become low, while the cost of fixing them remains high. He advised users to treat any logged-in website over the coming weeks as potentially compromised, avoid password reuse, exercise caution when connecting crypto wallets, and revoke token approvals from unrecognized sources. Previously, the PHP Foundation acknowledged that due to resource constraints, it delayed patching a critical security vulnerability first identified in 2024. On the same day, PHP developers released emergency patches for two critical vulnerabilities, but individual websites must still perform their own upgrades. Cloudflare CEO Matthew Prince noted that within 24 hours of the PHP vulnerability’s public disclosure, millions of exploitation attempts were recorded—thousands of which had already occurred prior to disclosure. According to W3Techs, PHP powers approximately 69% of websites with known server-side programming languages; these vulnerabilities could allow attackers to distribute malware or inject malicious scripts into websites. The U.S. Federal Bureau of Investigation’s cyber division also warned that these flaws could enable malicious actors to “remotely execute code within the PHP core, potentially compromising sensitive data and networks.” In a June interview with Cointelegraph, Amador previously warned that the widespread adoption of cutting-edge AI models has shifted the cybersecurity landscape, giving attackers the upper hand and contributing to the emergence of “bug apocalypse,” alongside a resurgence in DeFi hacks. Immunefi is the world’s largest bug bounty platform and has paid out $140 million in rewards to 650 protocols to date.
Immunefi CEO Warns of PHP Vulnerability and 'Vulnerability Doomsday' in Cybersecurity
ChaincatcherShare
Summary
Immunefi CEO Mitchell Amador highlighted vulnerability reports concerning PHP flaws, warning of a "vulnerability doomsday" as smaller websites fall behind on emergency updates. He urged users to avoid password reuse and revoke unauthorized token permissions. The PHP Foundation delayed a 2024 patch due to resource constraints, while Cloudflare reported millions of attempted exploits. W3Techs notes that PHP powers 69% of websites, with risks including malware and script injection. The FBI also issued a warning regarding remote code execution. Amid these vulnerability updates, exchanges continue to announce new token listings to meet evolving security and user demands.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.