Mitchell Amador warned internet users that websites could remain compromised for weeks, particularly smaller websites slower to adopt the emergency upgrades.

Internet users are still vulnerable to cyber exploits stemming from the PHP vulnerability, particularly through smaller websites that could take weeks to adopt the upgrade shipped last Wednesday, according to bug bounty platform Immunefi CEO Mitchell Amador.

“This is the vulnerability apocalypse” running on schedule, where finding vulnerabilities became cheap, but fixing them remains expensive, Amador told Cointelegraph.

“For the next few weeks, treat any site you log into as if it could already be compromised,” said Amador, warning users to avoid reusing passwords and to exercise caution when connecting their cryptocurrency wallets to websites. He also urged users to revoke unrecognized token approvals.

The comments come nearly a week after the PHP Foundation acknowledged that it delayed fixing a critical security flaw first identified in 2024, due to a shortage of resources. PHP developers released emergency patches for two critical vulnerabilities on the same day, but websites still need to independently upgrade.

In an interview published by Cointelegraph in June, Amador warned that the proliferation of frontier AI models changed the cybersecurity playing field in favor of attackers, causing a “vulnerability apocalypse” that led to the resurgence in decentralized finance (DeFi) hacks.

Percentage of programs with a confirmed critical vulnerability by time live.
Source: Immunefi

Immunefi is the world’s largest bug bounty platform that paid out $140 million in bounties across 650 protocols to date, according to its homepage .

Source link