Immunefi CEO: ‘Steal My Bitcoin’ PHP Crack Is AI-Driven ‘Vulnerability Apocalypse’ on Schedule
Immunefi CEO Mitchell Amador says the PHP vulnerability wave confirms his AI-driven ‘vulnerability apocalypse’ prediction, as exploit attempts reach millions.
The chief executive of bug bounty platform Immunefi says this week’s wave of PHP exploitation confirms the artificial intelligence-driven security crisis he predicted in June is unfolding as expected.
Mitchell Amador said in an interview this week that the situation amounts to “the vulnerability apocalypse” running on schedule, in which finding software vulnerabilities has become cheap while fixing them remains expensive. In a June interview, he warned that frontier AI models had shifted the cybersecurity playing field toward attackers and would drive a resurgence in decentralized finance hacks.
The trigger is a pair of critical flaws in PHP, the language behind roughly 69% of websites with a known server-side programming language, according to the research service W3Techs. The FBI Cyber Division said in a post on X on October 21 that the vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow malicious actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The same day, PHP developers shipped emergency patches, though every site operator must still upgrade independently.
Cloudflare’s network recorded thousands of exploit attempts before the flaws were public, hundreds of thousands within two hours of disclosure, and millions by the time Prince posted, the Cloudflare chief executive said in a post on X on October 22. Attempts are not confirmed breaches, and no successful mass compromise has been reported.
The week’s events also reached crypto directly. A researcher reportedly cracked the “Steal My Bitcoin” challenge, a server holding 0.02511679 BTC for anyone able to take it, using a PHP exploit on October 26, and the operator had to move the prize after discovering the server held the wrong wallet key. The report has appeared in a single outlet so far and its full details are unverified.
Amador advised users to treat any site they log into as potentially compromised for the next few weeks, avoid reusing passwords and revoke unrecognized token approvals. Smaller websites may take weeks to adopt the emergency upgrade, leaving users exposed in the meantime, he said.
The episode lands where the security economics meet the money. For crypto investors and protocol operators, the calculus Amador describes is asymmetric: automated discovery makes an exploit cheap to find while the fix still depends on a human deploying it. Immunefi, which has paid out $140 million in bounties across 650 protocols, sits on the defensive side of that market, and its own figures show hacked projects rarely recover. Its research found 80% of hacked protocols never fully bounce back, a gap the PHP wave widens if DeFi front ends inherit the same patch lag.
The FBI urged organizations that cannot update immediately to take affected systems offline, inventory PHP installations with priority on internet-facing systems, and monitor web servers for PHP processes unexpectedly launching command shells or downloading files. Reports of compromise go to local field offices or ic3.gov.
