PHP Flaws Spark ‘Vulnerability Apocalypse’ Warning for Crypto Users

Emergency patches for two critical PHP vulnerabilities have prompted a stark cybersecurity warning after the flaws generated millions of exploit attempts within 24 hours of their public disclosure. The PHP Foundation reportedly delayed addressing one issue, first identified in 2024, because of a lack of resources. Although updated PHP versions are available, websites must install them independently, leaving smaller sites vulnerable for weeks.

Cloudflare CEO Matthew Prince said the infrastructure network observed thousands of exploitation attempts even before disclosure and millions over the following day. According to W3Techs, PHP powers about 69% of websites with a known server-side programming language, while roughly one in five websites routes traffic through Cloudflare. The flaws could enable remote code execution, malware distribution and malicious script injection, according to the FBI’s Cyber Division.

Immunefi CEO Mitchell Amador called the situation a “vulnerability apocalypse” running on schedule, warning that inexpensive AI-assisted vulnerability discovery is benefiting attackers while remediation remains costly. He advised users to treat websites they log into as potentially compromised, avoid reusing passwords and exercise additional caution when connecting cryptocurrency wallets.

Crypto users should also review and revoke unrecognized token approvals, particularly if they have connected wallet addresses to smaller or unpatched websites. Patching server software is essential, but rapid credential rotation, limited wallet reuse and ongoing approval monitoring can reduce the risk of token theft while the ecosystem waits for slower websites to update.