AI models just exposed a vulnerability buried inside PHP for roughly ten years. PHP runs an estimated 70% of the internet, which puts an enormous number of websites, financial platforms, and crypto services directly in the firing line.
EasyA co-founder Dom Kwok raised the alarm, warning his audience, telling his audience that “the worst cyber attack in a decade is happening right now.”
He noted that “hackers are using it to take over servers without needing a password.” That is the core danger here. Attackers do not need credentials. They do not need to trick anyone. They walk straight in.
the worst cyber attack in a decade is happening right now.
here's how you can make sure you're not a victim.
what's going on?
an AI model just uncovered a 10 year old vulnerability in PHP, which powers 70% of websites. hackers are using it to take over servers without needing…
— Dom Kwok | EasyA (@dom_kwok) October 22, 2026
The Vulnerability
The vulnerability, known as PHP2Shell, was independently discovered by security firm Calif, using OpenAI’s GPT-5.6 Sol, and cloud security company Wiz, which used Google’s Gemini 4 Argon alongside GPT-5.6 Sol. It affects PHP versions stretching back roughly a decade. Patches arrived on October 21, but attackers were already exploiting the flaw before the fixes went public.
Why Crypto Users Face Risk
Crypto users carry high-value targets on their accounts. Exchanges, wallets, and DeFi platforms built on PHP infrastructure are all potentially exposed.
The market just experienced a major breach as over $91 million was stolen from Ledger. Further investigations revealed a supply chain filled with compromised wallets, putting the assets of millions of holders in danger.
This vulnerability adds another major failure point. XRP holders with accounts on affected platforms should treat this as a high-alert situation.
Multiple websites have shut down temporarily, as a compromised server can expose session tokens, API keys, and in some cases TLS private keys, giving attackers access to user data and account activity.
Steps to Take Right Now
Kwok issued a critical warning, and outlined several protective steps, and they apply directly to crypto users. Enabling two-factor authentication across every account is the most critical action. Even if a platform’s server is compromised, 2FA creates a second barrier that can stop an attacker from accessing individual accounts.
XRP holders should also stay alert to phishing activity and similar scams that typically follow large-scale disclosures like this.
Kwok specifically warned users to be “highly suspicious of sudden pop-ups asking for your credit card details” and to avoid websites pushing unsolicited “security updates.” These are common tactics attackers use to harvest credentials in the wake of a major breach event.
Any XRP held on a platform that has not confirmed patching should be considered at elevated risk until that confirmation arrives. Moving assets to a hardware wallet removes exposure entirely while the situation develops.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
