Immunefi CEO warns PHP vulnerability could leave websites exploitable for weeks.

on October 26, according to Cointelegraph, Immunefi CEO Mitchell Amador stated that internet users continue to face cyberattack risks stemming from PHP vulnerabilities, particularly among small websites that have been slow to adopt last Wednesday's patch updates and may take weeks to complete the upgrade. He characterized this as a planned "bug bounty doomsday," where discovering vulnerabilities is inexpensive while fixing them is costly. Amador advised treating any website requiring login as potentially compromised over the coming weeks, avoiding password reuse, exercising caution when connecting cryptocurrency wallets to sites, and revoking unrecognized token approvals. Previously, the PHP Foundation acknowledged delaying the fix for a critical security vulnerability first identified in 2024 due to resource constraints, with PHP developers releasing emergency patches for two critical vulnerabilities on the same day, though individual websites remain responsible for applying the updates themselves.

Cloudflare CEO Matthew Prince noted that network logs recorded millions of exploitation attempts within 24 hours of the vulnerability's public disclosure, with thousands already detected prior to the announcement. W3Techs estimates that PHP powers approximately 69% of websites utilizing known server-side programming languages. The FBI's Cyber Division warned that the vulnerability could enable malicious actors to "execute code remotely within the PHP core, potentially compromising sensitive data and networks."