News
Public · Published
PHP flaw shows AI 'vulnerability apocalypse' is on schedule: Immunefi CEO
The PHP Foundation delayed fixing a critical security flaw first identified in 2024 because of a shortage of resources. Emergency patches for two critical vulnerabilities were released last Wednesday, but websites must still upgrade independently, and smaller sites could take weeks.
Published:
Updated:
What happened
The PHP Foundation delayed fixing a critical security flaw first identified in 2024 because of a shortage of resources. Emergency patches for two critical vulnerabilities were released last Wednesday, but websites must still upgrade independently, and smaller sites could take weeks.
Confirmed
Global impact / market context
Finding software flaws has become cheap with AI, but fixing them remains expensive, so attackers can exploit unpatched sites faster than owners respond. Smaller websites with fewer resources stay exposed longest, and visitors who reuse passwords or connect crypto wallets risk losing funds to compromised pages.
Analyst inference
Amador links AI-driven vulnerability discovery to a resurgence in decentralized finance hacks, which means attacks on crypto protocols have risen again. Bug bounty platforms such as Immunefi benefit as projects pay for finding flaws, while site operators face rising upgrade and security costs.
Analyst inference
What to watch
- PHP released emergency patches for two critical vulnerabilities on the same day last Wednesday, but each website still needs to install the upgrade independently for protection. Confirmed
- Amador advises users to treat any site they log into as possibly compromised for the next few weeks, avoid reusing passwords, and be cautious connecting crypto wallets. Proposed
- Watch whether smaller website operators complete upgrades within weeks and whether deferred fixes keep crypto wallet approvals exposed, since unresolved flaws can translate into stolen funds and higher hack counts. Analyst inference