Immunefi CEO warns PHP flaws expose gap between AI discovery and fixes

Immunefi CEO Mitchell Amador warned that smaller websites could remain vulnerable for weeks after emergency PHP security updates, telling Cointelegraph that the incident illustrates the imbalance between increasingly cheap vulnerability discovery and expensive remediation. His warning concerns the time needed for individual website operators to deploy fixes, rather than the availability of patches.

Amador described the episode as evidence of the AI-driven “vulnerability apocalypse” he has warned about. He urged internet users to avoid reusing passwords, exercise caution when connecting cryptocurrency wallets to websites and revoke unfamiliar token approvals, according to Cointelegraph.

The PHP project released emergency updates on October 21 addressing two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation said the flaws can, under the right conditions, allow attackers to execute code on servers without authentication. Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The foundation traced early signs of the out-of-memory problem behind one vulnerability to security work in 2024. Developers considered several fixes, but each involved difficult trade-offs, including compatibility problems, potential denial-of-service risks or changes affecting third-party extensions. At that stage, a possible exploit had been theorized without concrete attack paths being identified.

Security researcher Wiz said AI substantially reduced the effort required to develop and adapt working exploits. Previously, attackers would have needed extensive specialist work to account for differences in PHP versions, configurations and memory behavior. Its researchers said models helped make repeated testing and debugging practical across multiple applications.

The potential impact extends beyond a single website platform because the weaknesses reside in PHP itself. Wiz demonstrated attacks against deployments of WordPress, Drupal and Joomla, and said otherwise secure application code does not remove exposure to a vulnerable underlying runtime. It also demonstrated access to sensitive process memory containing information such as passwords, tokens and API keys.

Those demonstrations establish possible consequences, not proof that every affected website has been breached. Google Cloud rated both flaws critical, with severity scores of 9.2, while noting that mitigating circumstances can make exploitation harder. It said its own infrastructure was not vulnerable, although customers running PHP applications could be exposed.

The response also depends on how applications are hosted and maintained. Google Cloud's guidance distinguishes services receiving automatic updates from deployments requiring operators to rebuild images or redeploy applications. It also says PHP 8.1 and earlier will not receive fixes from the upstream PHP project because those versions have reached end of life.

For website operators, the next step is ensuring patched software is actually running across affected deployments. Google Cloud says protective filtering is a temporary compensating measure, not a replacement for upgrading and redeploying. Amador's weeks-long warning remains an assessment of potential patching delays, with the continuing risk shaped by how quickly individual operators complete that work.