# Immunefi CEO Warns PHP Sites May Remain Vulnerable for Weeks By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/41302 Published: 2026-10-26T20:31:57.000Z Updated: 2026-10-26T20:31:57.000Z Section: Technology > Mitchell Amador said smaller sites may need weeks to install the fixes and urged users to treat sites they log into as potentially compromised. Immunefi CEO Mitchell Amador urged internet users to treat sites they log into as potentially compromised for the next few weeks as smaller operators catch up on PHP security patches. “For the next few weeks, treat any site you log into as if it could already be compromised,” Amador said. He advised users not to reuse passwords, to be cautious when connecting crypto wallets to websites and to revoke token approvals they do not recognize. Amador said smaller sites could take weeks to adopt the patches. PHP developers released emergency fixes for two critical vulnerabilities on Oct. 21, but website operators must install them themselves. The PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical flaw first identified in 2024. The warning follows [millions of exploitation attempts against the PHP flaws](). Amador described the gap between finding vulnerabilities and fixing them as a “vulnerability apocalypse.” The patches are available, but operators still need to install them. ## Links in this article - [millions of exploitation attempts against the PHP flaws](https://www.tokenpost.com/news/technology/38073)