Immunefi CEO: Recent PHP Security Breach Confirms AI-Driven 'Vulnerability Apocalypse' Timeline
According to Immunefi's chief executive, the recent PHP security breach demonstrates that an AI-powered vulnerability crisis is underway, leaving countless websites exposed for potentially several weeks.
According to Mitchell Amador, CEO of bug bounty platform Immunefi, online users remain exposed to cyber attacks resulting from the PHP security flaw, especially when visiting smaller web platforms that may require several weeks to implement the security update released last Wednesday.
Amador explained to Cointelegraph that "This is the vulnerability apocalypse" proceeding as predicted, characterized by a scenario where discovering security weaknesses has become inexpensive, while remedying them continues to be costly.
"For the next few weeks, treat any site you log into as if it could already be compromised," Amador stated, advising users against password reuse and recommending heightened vigilance when linking their cryptocurrency wallets to web platforms. He further emphasized the importance of revoking any token approvals that appear unfamiliar.
These remarks follow approximately one week after the PHP Foundation admitted to postponing the resolution of a severe security vulnerability originally discovered in 2024, citing insufficient resources as the reason. On the same day, PHP developers issued emergency security updates addressing two critical flaws, though individual websites must still implement these upgrades independently.
During a Cointelegraph interview published in June, Amador cautioned that the widespread availability of advanced AI models had shifted the cybersecurity landscape to favor those launching attacks, triggering a "vulnerability apocalypse" that contributed to an increase in decentralized finance (DeFi) security breaches.
According to information on its homepage, Immunefi represents the world's largest bug bounty platform, having distributed $140 million in rewards across 650 protocols to date.
PHP flaw drew millions of exploit attempts within hours
Cloudflare's CEO Matthew Prince reported in a Thursday X post that the network detected millions of exploitation attempts during the 24-hour period following the public disclosure of the PHP vulnerabilities, and thousands of attempts were observed even prior to their official announcement.
The internet infrastructure company, which assists websites in achieving faster loading speeds and shielding users from cyber dangers, reports that approximately one in five websites globally directs traffic through Cloudflare.
According to estimates from research service W3Techs, PHP is the technology behind roughly 69% of websites that utilize a known server-side programming language. These security flaws could enable attackers to distribute malware or insert malicious code into websites across the globe.
In a Wednesday X post, the FBI's Cyber Division also issued a warning that these vulnerabilities could enable malicious actors to "remotely execute code in PHP core, potentially compromising sensitive data and networks."