PHP security flaw heightens cyber risk for websites and crypto users

Traders Union
All News
Crypto
Php security flaw cyber risk

Highlights

Millions of exploit attempts targeted PHP vulnerabilities within 24 hours of disclosure, with Cloudflare noting widespread pre-disclosure activity as well.
Roughly 69% of websites use PHP according to W3Techs, and each site requires an individual upgrade, leaving the vast majority still exposed.
Immunefi has paid $140 million in bounties related to software vulnerabilities, while both the FBI and PHP Foundation warn that unpatched flaws enable code execution and compromise sensitive data.

Patch rollout leaves broad exposure

As reported by Cointelegraph, Immunefi CEO Mitchell Amador says internet users remain vulnerable to exploits tied to the PHP flaw because many websites still have to independently apply the emergency update shipped last Wednesday.

Amador says the industry is moving through a "vulnerability apocalypse," where discovering software flaws has become cheap while fixing them remains expensive. He urges users to treat any site they log into over the next few weeks as potentially compromised, avoid reusing passwords, be cautious when connecting cryptocurrency wallets, and revoke any token approvals they do not recognize.

The warning follows the PHP Foundation's acknowledgement that it delayed fixing a critical flaw first identified in 2024 because of limited resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but each website operator still has to complete the upgrade separately.

In a June interview, Amador said the spread of frontier AI models has shifted cybersecurity conditions in favor of attackers, contributing to a resurgence in decentralized finance hacks. Immunefi describes itself as the largest bug bounty platform globally and says it has paid $140 million in bounties across 650 protocols to date.

Exploit attempts underscore wider industry impact

Cloudflare CEO Matthew Prince says the company saw millions of exploit attempts in the 24 hours after the PHP vulnerabilities became public, along with thousands of attempts even before disclosure, according to a Thursday post on X.

Cloudflare says about one in five websites worldwide routes traffic through its network, underscoring the scale of potential exposure. Research firm W3Techs estimates PHP powers about 69% of websites using a known server-side programming language, suggesting the flaw could have broad consequences across the internet.

The vulnerabilities may allow attackers to spread malware or inject malicious scripts into websites, creating risks for user credentials, sensitive data and digital asset security. The FBI's Cyber Division also warns in a Wednesday X post that the flaws may let malicious actors remotely execute code in PHP core and potentially compromise sensitive data and networks.

Our earlier coverage of cybersecurity investment trends highlighted how funding surged on the back of fewer but much larger late-stage rounds, with AI-focused and identity security startups attracting the most capital. We also noted that consolidation remained active through major acquisitions, reflecting sustained demand for security solutions as AI-driven risks accelerate.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.