Immunefi CEO warns PHP vulnerability could leave websites exploitable for weeks.

According to Cointelegraph, Immunefi CEO Mitchell Amador warned that internet users remain at risk of cyberattacks originating from PHP vulnerabilities, particularly on smaller websites that have been slow to apply the upgrade patches released last Wednesday, which could take weeks to complete the updates. He described it as an orchestrated "vulnerability doomsday," characterized by low costs to discover vulnerabilities and high costs to patch them. Amador advised treating any website requiring a login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting crypto wallets to sites, and revoking unrecognized token approvals. The PHP Foundation previously acknowledged that resource shortages delayed the fix for a critical security vulnerability first identified in 2024. While PHP developers issued emergency patches for two critical vulnerabilities on the same day, websites must still manually apply the updates. Cloudflare CEO Matthew Prince noted that millions of exploitation attempts were recorded across the web within 24 hours of the disclosure, with thousands already underway prior to the announcement. W3Techs estimates that PHP supports approximately 69% of websites using known server-side programming languages. The FBI Cyber Division warned that the flaw could allow malicious actors to "remotely execute code within the PHP core, potentially compromising sensitive data and networks."