Overview
- Security researchers say a critical PHP vulnerability exploited in mid-October allowed attackers to steal large troves of user and site data from millions of websites.
- Avast reports that criminals are reusing those real records plus AI agents to automate high-volume phishing that targets private email accounts and online-banking customers.
- The company warns some stolen certificate keys may make fraudulent sites appear to use valid HTTPS which means the browser lock icon no longer guarantees a site is genuine.
- Avast advises users to revoke unnecessary third-party app and AI-tool access in Google, Apple and mail accounts, use unique passwords for each service, and open bank sites only via official URLs or apps.
- There are no widely reported mass bank takeovers tied to these incidents yet, but experts say the attacks could lead to account takeover, data theft, financial loss and regulatory or reputational harm if they succeed.