A critical vulnerability, hidden in PHP for nearly a decade, has been exposed by recent advances in artificial intelligence, putting a vast portion of the internet—along with major financial and crypto platforms—at significant risk.
Vulnerability Discovered by AI and Security Researchers
EasyA co-founder Dom Kwok drew urgent attention to the issue, stating that the world is facing “the worst cyber attack in a decade.” PHP, which powers around 70% of all websites, forms the backbone for countless financial and digital asset platforms. The sheer scope of its usage has raised immediate concerns for the security of large-scale web infrastructure.
Dom Kwok described the unfolding crisis, sharing that hackers are leveraging this flaw to “take over servers without needing a password.” He explained that attackers do not rely on tricking users, but can directly breach vulnerable systems.
The vulnerability, identified as PHP2Shell, was detected through the efforts of security companies and advanced AI models. Security firm Calif used OpenAI’s GPT-5.6 Sol, while cloud security provider Wiz employed Google’s Gemini 4 Argon and the same OpenAI model to uncover the flaw. The bug affects PHP versions dating back ten years, and though patches were issued on October 21, malicious actors began exploiting the weakness before a fix became widely available.
Mini dictionary: EasyA is an educational technology company focused on onboarding developers into blockchain and Web3. Calif and Wiz are cybersecurity firms specializing in protecting cloud and web infrastructure.
Crypto Platforms and Users Directly Impacted
The vulnerability has put financial institutions, crypto exchanges, wallets, and DeFi platforms built on PHP at heightened risk. Crypto users have become key targets due to the high value of assets stored on these platforms.
A recent incident in the market underscored the potential damage. Attackers stole over $91 million from hardware wallet provider Ledger, with investigations revealing a compromised supply chain that left the assets of millions vulnerable.
This new PHP vulnerability has increased the threat for holders of digital assets, particularly those using affected services. Several websites have temporarily gone offline as a precaution, since a breached server could expose sensitive information such as session tokens, API keys, and even TLS private keys, giving attackers further access to user accounts and data.
| Platform/Asset | Incident | Approximate Value at Risk |
|---|---|---|
| Ledger | Compromised supply chain, funds drained | $91 million |
| DeFi Exchanges/Wallets | Exposed to PHP2Shell vulnerability | Millions of user accounts |
Security Advice for Crypto Users
Dom Kwok urged users, especially those in the crypto community, to take immediate action. He emphasized enabling two-factor authentication (2FA) on all accounts as the highest priority. 2FA provides an extra layer of protection, making unauthorized access substantially more difficult, even if an attacker controls a compromised server.
Kwok advised users to view any website requesting urgent “security updates” or asking for credit card details with extreme suspicion, as attackers often exploit large breaches with phishing campaigns and fake prompts.
He strongly recommended that XRP holders consider moving assets out of platforms that have not explicitly confirmed applying the security patch. Using a hardware wallet can isolate funds from active attacks while the general risk remains unresolved.
Users were also encouraged to remain alert to phishing schemes, as these tend to become more prevalent during major cyber incidents.
