Widespread PHP Vulnerability Heightens Cybersecurity Risks for Internet Users

PHP Vulnerability Escalates Online Security Concerns

Amador described the situation as a "scheduled apocalypse of vulnerabilities," noting that while discovering security flaws has become inexpensive, the cost of fixing them remains significant.

He advised users to treat any website they log into over the next few weeks as potentially compromised, urging them not to reuse passwords and to exercise caution when connecting cryptocurrency wallets to websites. Additionally, he recommended revoking token permissions that appear suspicious or unexpected.

These remarks followed the PHP Foundation’s admission that it delayed patching a critical vulnerability identified earlier this year due to resource constraints. Although emergency patches for two critical vulnerabilities were issued simultaneously, websites are still required to manually implement the updates.

In a June interview with Cointelegraph, Amador warned that the rapid advancement of cutting-edge AI models has shifted the cybersecurity landscape in favor of attackers, triggering what he calls a "vulnerability apocalypse" and reigniting attacks on decentralized finance (DeFi).

Immunefi, recognized as the world’s largest bug bounty platform, has disbursed $140 million in rewards across 650 protocols, highlighting its leading role in vulnerability detection and remediation.

## PHP Vulnerability Triggered Millions of Exploit Attempts Within Hours

Matthew Prince, CEO of Cloudflare, reported that the network registered millions of exploitation attempts within 24 hours after the PHP vulnerabilities became public and thousands of attempts before disclosure, as shared in a Thursday post on X.

Cloudflare, a key internet infrastructure provider helping websites load faster and secure users against cyber threats, estimated that roughly one in five websites globally direct their traffic through its services.

Data from research firm W3Techs indicates that PHP is used by approximately 69% of websites with a known server-side programming language. These vulnerabilities could enable hackers to inject malicious software or scripts into websites worldwide.

The FBI’s Cyber Division also cautioned that these vulnerabilities allow attackers to remotely execute code within PHP’s core, potentially compromising sensitive data and networks, as highlighted in a Wednesday post on X.

The PHP vulnerability's significance lies in its widespread impact across the web, exacerbating the risk of data breaches and malware infections, particularly given the slow update adoption by smaller sites and the ongoing high volume of exploitation attempts.