Immunefi CEO: PHP Vulnerability Confirms AI Vulnerability Doomsday as Scheduled, Warns of Wallet Risks

Mitchell Amador, CEO of bug bounty platform Immunefi, warned that internet users still face cyberattack risks stemming from the PHP vulnerability, particularly smaller websites that are slower to adopt emergency upgrades, which may take weeks to complete patching. He stated that the "vulnerability doomsday" is arriving as planned—where the cost of discovering vulnerabilities becomes cheap, while the cost of fixing them remains high. He advised users to treat any website they log into over the next few weeks as potentially compromised, avoid reusing passwords, exercise caution when connecting crypto wallets, and revoke unrecognized token approvals. Previously, the PHP Foundation acknowledged that, due to resource shortages, it delayed fixing a critical security vulnerability first discovered in 2024. PHP developers issued emergency patches for two critical vulnerabilities the same day, but each website still needs to complete its own upgrades. Cloudflare CEO Matthew Prince stated that within 24 hours of the public disclosure of the PHP vulnerability, the network recorded millions of exploitation attempts, with thousands of attempts even before the disclosure. According to W3Techs estimates, PHP powers approximately 69% of websites with known server-side programming languages, and these vulnerabilities could allow attackers to spread malware or inject malicious scripts into websites. The U.S. Federal Bureau of Investigation's cyber division also warned that these vulnerabilities could allow malicious actors to "execute code remotely in the PHP core, potentially compromising sensitive data and networks." In a June interview with Cointelegraph, Amador warned that the proliferation of cutting-edge AI models has shifted the cybersecurity landscape, giving attackers an advantage, leading to the "vulnerability doomsday" and triggering a resurgence in DeFi hacks. Immunefi is the world's largest bug bounty platform, having paid out $140 million in bounties to 650 protocols to date.