Immunefi CEO Warns PHP Vulnerability Could Remain Exploitable for Weeks

According to Cointelegraph, Mitchell Amador, CEO of Immunefi, stated that internet users remain at risk of cyberattacks stemming from PHP vulnerabilities, particularly affecting smaller websites that have been slow to implement the upgrade patch released last Wednesday, which may take weeks to complete. He described this as a planned “vulnerability doomsday,” where exploiting the vulnerability is inexpensive while fixing it is costly. Amador advised users to treat any login website as potentially compromised over the coming weeks, avoid password reuse, exercise caution when connecting crypto wallets to websites, and revoke authorization for unrecognized tokens. Previously, the PHP Foundation acknowledged delaying the patching of a critical security vulnerability first identified in 2024 due to resource constraints; PHP developers released emergency patches for the two critical vulnerabilities on the same day, but websites must still update themselves.
Cloudflare CEO Matthew Prince said that within 24 hours of the vulnerability being disclosed, millions of exploitation attempts were recorded on the network, with thousands already occurring prior to disclosure. W3Techs estimates that PHP powers approximately 69% of websites using known server-side programming languages. The FBI’s cyber division warned that the vulnerability could allow malicious actors to “remotely execute code within the PHP core, potentially compromising sensitive data and networks.”