A critical security hole that sat unnoticed in PHP for about ten years has been dragged into the open with help from artificial intelligence, and the fallout is now reaching crypto exchanges, wallets and DeFi platforms that run on the widely used scripting language. EasyA co-founder Dom Kwok used his social media megaphone to flag the danger, telling followers that “the worst cyber attack in a decade is happening right now.”

The flaw, tracked as PHP2Shell, affects PHP versions going back roughly a decade. PHP underpins an estimated 70% of websites, a reach that turns a single bug into a problem for a large slice of the internet, including financial services and digital-asset infrastructure. Patches landed on October 21, but attackers…