• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.

• Tiffany Tang founded DrinkFolks after a transformative journey across Asia in 2023 and 2024.
• Tang's layoff in 2023 led her to Bali, where she decided to extend her 30-day trip to over a year.
• DrinkFolks, inspired by Tang's travels, supports women-led farms and brings jamu to the US market.

This as-told-to essay is based on a conversation with Tiffany Tang, the 30-year-old founder of DrinkFolks. It has been edited for length and clarity.

I'm the founder and CEO of DrinkFolks, which brings jamu, a 1,300-year-old Indonesian herbal remedy, to the US as a prebiotic root tonic.

For the first two years of my career, I was an assistant director at a gallery owned by the first female fine arts dealer in America. From 2017 to 2021, I worked at Christie's International Real Estate in marketing and communications roles.

For the next year, I was a senior communications manager at CSM Sport & Entertainment before taking on a similar role at a fintech company that helped millions of Americans sustainably build their credit scores through rewards.

I felt positively about that job, but I was laid off in May 2023

I was grateful to work there. We were doing big things, and I really learned what it was like to be at a mission-driven company.

The most interesting thing about my layoff was how incredibly calm I felt upon hearing the news. Our CMO told me first, and she was a friend, my college professor, and an executive I admire and respect.

When she told me, I said I didn't blame her, and this was a time for a reset. Turns out, the layoff was the best thing that could've ever happened to me.

A few weeks after my layoff, I booked a one-way ticket to Bali

For a long time, my self-worth was my net worth — my title, my salary, my career trajectory. When the layoff hit, I lost my sense of self. Reflecting afterward, all I could think was: who am I without the high-paying job?

A few weeks earlier, I had watched the movie "Eat, Pray, Love." When the layoff came, something in me said that this was my moment. I opened Kayak, found a one-way ticket to Bali for around $1,000, and booked it. Bali felt approachable and warm.

What was supposed to be a 30-day reset changed the course of my life

I originally planned to travel in Southeast Asia for a month but ended up staying from June 2023 through August 2024.

My awakening happened on day three. One of the first things I did in Bali was a Panchakarma, a full-body Ayurvedic detox at a retreat in Ubud. There was an optional silent day; one of the first times in my life I rooted and looked inward.

Sitting with my journal, I knew I had to stay. I was still negotiating my severance, so I did the math: my savings, my investments, what each month would cost. When my severance came through a few weeks later, it jump-started the journey.

The deeper turning point was Hong Kong

Everyone I met understood me on an indescribable level. It was the only time in my life I was speaking Cantonese to people outside my family, reconnecting with my heritage. By the time I came home for the holidays, I had decided: I was moving to Asia.

The spark for the company was the women I met. Across Indonesia and Southeast Asia, I sat with women quietly building something of their own. I wanted to help these women build generational wealth for their families. I built DrinkFolks as a way to sustainably invest in them — 3% of every sale goes to women-led farms and nonprofits across Southeast Asia through our FolksFund — while supporting health stateside by bringing ancient wisdom into people's homes.

I started the company in January 2024, took every jamu class I could find in Bali, visited the source of jamu in Yogyakarta, and reformulated recipes in my Hong Kong kitchen.

By October 2024, I was back in the US, working with California food scientists to scale up my home-tested recipe. We launched in NYC in October 2025. Today, we're in 70+ stores across the US.

Living in Southeast Asia made the math work

My salary before the layoff was $160,000 a year, plus equity. When I set off, I had roughly $14,000 between savings and severance — my spreadsheet calculated 4.6 months of runway — and I felt comfortable investing that in myself.

I budgeted like it was my job. I tracked my actual spending obsessively for the first four and a half months and came in at roughly $7,700 total.

All-in, I averaged about $1,300 to $2,300 a month, including flights, lodging, food, everything. My money stretched furthest in Cambodia and least in Hong Kong, which was financially similar to New York City. For comparison: my overhead, including my mortgage, maintenance, electricity, and WiFi in New York today is about $2,500 a month.

In terms of cost of living comparisons, here's my breakdown

Healthcare was the biggest surprise, in the best way. I got into a motorcycle accident on the Pakse Loop in Laos, and seven stitches cost me around seven dollars, including painkillers and a week of antibiotics.

Cambodia was the best value. It's the most adventurous, outdoorsy country I visited, and I didn't want to explore alone, so I stayed in hostels for as little as $6 a night — partly a budget move, mostly a way to meet people. It's also where I met my first fellow Americans of the entire trip.

Hong Kong was the opposite — groceries and eating out gave me real sticker shock. I softened it with a genuine energy exchange: I moved in with a college friend and threw dinner parties several times a week, cooking meals for them in exchange for a place to stay. It was worth every dollar — I met some of my truest friends and future business partners there.

The layoff was honestly the best thing that ever happened to me

It gave me the confidence to build DrinkFolks, a better sense of my heritage, and a version of myself I'm proud of. I've learned to never say never, but right now, I'm exactly where I'm supposed to be.

My advice is to use your layoff as your launchpad. Things happen for you, not in spite of you. If you have even the slightest chance to live in that moment for yourself — for me, that was travel — take it as a gift and a blessing, not a crisis to survive.

Treat budgeting as freedom, not constraint. My money stretched so much further than I imagined. Clear parameters gave me the space to figure out who I am outside my job.