Key facts
- PHP vulnerability described as 'vulnerability apocalypse' by Immunefi CEO Mitchell Amador.
- Websites could remain compromised for weeks due to slow adoption of emergency upgrades.
- Millions of exploit attempts were seen in 24 hours after PHP vulnerabilities were revealed.
- FBI warned of remote code execution in PHP core, potentially compromising data and networks.
Internet users remain vulnerable to cyber exploits from a critical PHP vulnerability, with smaller websites potentially taking weeks to adopt emergency upgrades, according to Immunefi CEO Mitchell Amador. He described the situation as a "vulnerability apocalypse" where AI models have made finding vulnerabilities cheap, but fixing them expensive. Amador advised users to treat all sites as potentially compromised for the next few weeks, avoid reusing passwords, and be cautious connecting crypto wallets. The PHP Foundation had previously delayed fixing the flaw due to resource shortages. Millions of exploit attempts were recorded within 24 hours of the vulnerabilities being revealed, according to Cloudflare CEO Matthew Prince.