Cybersecurity professionals are urging website operators—and anyone who uses crypto services on the web—to treat PHP-related vulnerabilities as an active risk in the near term, even after emergency patches were released. Immunefi CEO Mitchell Amador said that many smaller sites may take weeks to apply updates independently, leaving users exposed longer than the initial disclosure timeline suggests.

Amador’s warning comes shortly after the PHP Foundation acknowledged it delayed fixing a critical flaw first identified in 2024, citing a shortage of resources. While emergency patches for two critical vulnerabilities were released the same day, the responsibility still falls on individual websites to upgrade their installations.

Key takeaways

Immunefi CEO Mitchell Amador said users should assume any site they log into could be compromised for the next few weeks.
Even with emergency PHP patches available, websites must still upgrade themselves—smaller operators may lag for weeks.
Amador advised users not to reuse passwords and to exercise caution when connecting cryptocurrency wallets to websites.
He also recommended revoking token approvals that users do not recognize to reduce the impact of potential malicious activity.
Multiple parties reported rapid exploit activity after public disclosure, including reports of millions of attempts within 24 hours.

Why PHP updates may not arrive fast enough

Amador framed the situation as part of a recurring pattern in modern security: vulnerabilities can be identified quickly, but remediation is often slower and more costly—especially for the long tail of smaller web properties. “This is the vulnerability apocalypse” running on schedule, Amador told Cointelegraph, arguing that the time gap between disclosure and widespread patch adoption is where the real harm occurs.

In practical terms, his advice is aimed at users who may interact with websites that have not yet upgraded their PHP versions. “For the next few weeks, treat any site you log into as if it could already be compromised,” he said. For crypto users, that translates into heightened caution around wallet connections, where malicious sites may attempt to trick users into approving token permissions or interacting with harmful contracts.

Amador further emphasized basic hygiene actions that can reduce downstream damage if a website is compromised, including avoiding password reuse and revoking unrecognized token approvals.

PHP Foundation delay and emergency patches

Cointelegraph previously reported that the PHP Foundation acknowledged it delayed fixing a critical security flaw first identified in 2024 due to a shortage of resources. The same reporting notes that developers issued emergency patches for two critical vulnerabilities on the day of the emergency release, but did not eliminate the core issue: each website still needs to update its own environment.

This distinction matters for risk management. A patch release does not automatically translate to immediate protection across the internet, and defenders who assume “patched” means “everywhere” may underestimate how long exploitation opportunities can persist—particularly for sites that rely on shared hosting or have less frequent update cycles.

Earlier coverage from Cointelegraph also quoted Amador warning that shifts in the cybersecurity landscape make these cycles more dangerous. In a June interview, he linked the “vulnerability apocalypse” framing to how changing attacker capabilities and a broader security race can accelerate the discovery-to-exploit path, contributing to high-profile incidents including DeFi hacks.

Exploit attempts reported quickly after disclosure

The urgency behind Amador’s warning is supported by reports of fast-moving exploitation. Cointelegraph cited Cloudflare CEO Matthew Prince, who said the network saw “millions of exploit attempts” in the 24 hours after the PHP vulnerabilities were publicly revealed, according to a Thursday X post attributed to Prince. He also noted thousands of attempts before public disclosure.

That matters because PHP remains widely deployed. According to Cloudflare, about one in five websites worldwide routes traffic through Cloudflare’s infrastructure, which the company says helps protect users and speed up site delivery. Meanwhile, W3Techs estimates that PHP powers roughly 69% of websites using a known server-side programming language, indicating a large potential blast radius if vulnerabilities enable remote compromise, malware deployment, or malicious code injection.

Such concerns were echoed by the FBI’s Cyber Division. In a Wednesday X post, the division warned that the flaws may enable malicious actors to “remotely execute code in PHP core,” with the potential to compromise sensitive data and networks.

What users and operators should do next

The main uncertainty in the coming days is not whether patches exist, but how quickly sites are upgraded in practice. Amador’s guidance effectively asks users to bridge that gap by assuming compromise is possible—even if only a small portion of websites are actually vulnerable at any given moment.

For website operators, the immediate priority is ensuring PHP is updated and that hosting environments follow through on those upgrades. For crypto users, Amador’s remarks suggest taking a conservative posture around wallet connections: avoid engaging with risky or unfamiliar web pages, and review token approvals to revoke anything that isn’t clearly needed or recognized.

As exploit campaigns typically accelerate around disclosure and then taper as patch coverage improves, the next watch item for readers is the pace of PHP upgrade adoption across hosting providers and individual sites—especially smaller web properties that may take longer to update and are therefore most likely to remain part of the exposure window.