Internet users remain exposed to cyberattacks exploiting PHP vulnerabilities, particularly through smaller websites that could take weeks to install the upgrade released last Wednesday, according to Mitchell Amador, CEO of bug bounty platform Immunefi.

“This is the vulnerability apocalypse” running on schedule, in which finding vulnerabilities has become cheap while fixing them remains expensive, Amador told Cointelegraph.

“For the next few weeks, treat any site you log into as if it could already be compromised,” Amador said. He warned users not to reuse passwords and to exercise caution when connecting cryptocurrency wallets to websites. He also urged users to revoke any unrecognized token approvals — standing permissions that allow third-party contracts to draw funds from a connected wallet until they are explicitly revoked.

Amador’s comments came nearly a week after the PHP Foundation acknowledged that it had delayed fixing a critical security flaw first identified in 2024 because of a shortage of resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but individual websites still need to install the updates independently. Because PHP runs on each site’s own server, the patches offer no protection until the operator applies them.

In a Cointelegraph interview published in June, Amador said the spread of frontier artificial intelligence models had shifted the cybersecurity landscape in favor of attackers. He linked that change to a “vulnerability apocalypse” and a resurgence in decentralized finance (DeFi) hacks.

Percentage of programs with a confirmed critical vulnerability by time live. Source: Immunefi.

Immunefi describes itself as the world’s largest bug bounty platform. According to its homepage, the company has paid $140 million in bounties across 650 protocols to date.

PHP flaw drew millions of exploit attempts within hours

Cloudflare CEO Matthew Prince said the network recorded millions of exploit attempts during the 24 hours after the PHP vulnerabilities were publicly revealed, as well as thousands of attempts before their disclosure. He made the claim in a Thursday post on X.

About one in five websites worldwide routes traffic through Cloudflare, according to the internet infrastructure company, which helps websites load faster and protects users from cyber threats.

Research service W3Techs estimates that PHP powers about 69% of websites with a known server-side programming language. The vulnerabilities could allow attackers to distribute malware or inject malicious scripts into websites worldwide.

The FBI’s Cyber Division also warned that the vulnerabilities could allow malicious actors to “remotely execute code in PHP core, potentially compromising sensitive data and networks,” according to a Wednesday post on X. Remote code execution is considered among the most serious classes of web vulnerabilities because a successful exploit can give an attacker direct control over the affected server.