Cyber

Immunefi

Tornado Cash

Internet users are still vulnerable to cyber exploits stemming from the PHP vulnerability, particularly through smaller websites that could take weeks to adopt the upgrade shipped last Wednesday,&nbsp; according to bug bounty platform Immunefi CEO Mitchell Amador.
“This is the vulnerability apocalypse” running on schedule, where finding vulnerabilities became cheap, but fixing them remains expensive, Amador told Cointelegraph.
“For the next few weeks, treat any site you log into as if it could already be compromised,” said Amador, warning users to avoid reusing passwords and to exercise caution when connecting their cryptocurrency wallets to websites. He also urged users to revoke unrecognized token approvals.
The comments come nearly a week after the <a href="https://ct.com/news/php-foundation-admits-structural-failure-delayed-critical-security-fix" rel="noopener noreferrer nofollow">PHP Foundation acknowledged</a> that it delayed fixing a critical security flaw first identified in 2024, due to a shortage of resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but websites still need to independently upgrade.
In an <a href="https://ct.com/news/frontier-ai-models-vulnerability-apocalypse-crypto-security-immunefi-ceo" rel="noopener noreferrer nofollow">interview published by Cointelegraph</a> in June, Amador warned that the proliferation of frontier AI models changed the cybersecurity playing field in favor of attackers, causing a “vulnerability apocalypse” that led to the resurgence in decentralized finance (DeFi) hacks.
<img src="https://s3-images.ctmedia.io/media/content/2026/10/01M5W7YK4P952T4BR70CEWF1MF/pasted-image-2934.png" alt="" width="1234" height="765">
Percentage of programs with a confirmed critical vulnerability by time live. Source: Immunefi
Immunefi is the world’s largest bug bounty platform that paid out $140 million in bounties across 650 protocols to date, according to its <a href="https://immunefi.com/" rel="noopener noreferrer nofollow">homepage</a>.
Related: <a href="https://ct.com/news/cysic-exploiter-eth-tornado-cash-white-hat-offer" rel="noopener noreferrer nofollow">Cysic dangles a 10% bounty, hacker pours loot into Tornado Cash</a>
<h2 id="php-flaw-drew-millions-of-exploit-attempts-within-hours">PHP flaw drew millions of exploit attempts within hours</h2>
According to Cloudflare’s CEO Matthew Prince, the network saw <a href="https://ct.com/news/cloudflare-millions-exploit-attempts-php-vulnerability-disclosure" rel="noopener noreferrer nofollow">millions of exploit attempts</a> in the 24 hours after the PHP vulnerabilities were publicly revealed and thousands of attempts even before their disclosure, he wrote a Thursday X<a href="https://x.com/eastdakota/status/2113079352682570051" rel="noopener noreferrer nofollow"> post</a>.
About one in five websites worldwide routes traffic through <a href="https://www.cloudflare.com/application-services/" rel="noopener noreferrer nofollow">Cloudflare</a>, according to the internet infrastructure company, which helps websites load faster and protect users from cyber threats.
Research service W3Techs <a href="https://w3techs.com/technologies/details/pl-php" rel="noopener noreferrer nofollow">estimates</a> that PHP powers about 69% of websites with a known server-side programming language. The vulnerabilities may allow attackers to spread malware or inject malicious scripts into websites around the world.
The FBI’s Cyber Division also warned that the vulnerabilities may allow malicious actors to “remotely execute code in PHP core, potentially compromising sensitive data and networks,” according to a Wednesday X<a href="https://x.com/FBICyberDiv/status/2112921648252719420" rel="noopener noreferrer nofollow"> post</a>.
Magazine: <a href="https://cointelegraph.com/features/wrong-number-text-crypto-scam" rel="noopener noreferrer nofollow">How a ‘Wrong Number’ message turned into a $3.4M crypto scam</a>

PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO

Table of Contents

Cointelegraph

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!