Immunefi CEO Warns PHP Sites May Remain Vulnerable for Weeks

Immunefi CEO Mitchell Amador urged internet users to treat sites they log into as potentially compromised for the next few weeks as smaller operators catch up on PHP security patches.

“For the next few weeks, treat any site you log into as if it could already be compromised,” Amador said. He advised users not to reuse passwords, to be cautious when connecting crypto wallets to websites and to revoke token approvals they do not recognize.

Amador said smaller sites could take weeks to adopt the patches. PHP developers released emergency fixes for two critical vulnerabilities on Oct. 21, but website operators must install them themselves. The PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical flaw first identified in 2024.

The warning follows millions of exploitation attempts against the PHP flaws. Amador described the gap between finding vulnerabilities and fixing them as a “vulnerability apocalypse.” The patches are available, but operators still need to install them.