This week, AI-discovered security flaws in PHP sent website owners around the world scrambling. If your business website runs on WordPress, it runs on PHP, and you need to check it’s been updated.
On 21 October 2026, the people behind PHP released urgent fixes for two critical vulnerabilities, nicknamed PHP2Shell. Within a day, government websites in Europe and elsewhere had gone offline, and the organisation behind Wikipedia took some of its systems down as a precaution.
What makes this story different is how the flaws were found. They had been hiding in PHP’s code for years, and artificial intelligence found them. This article explains what PHP is, why these flaws matter so much, and what you should do about your own website today.
What is PHP?
PHP is a programming language that runs on the web server, building each page before it reaches your visitor’s browser.
Think of a restaurant. Your website’s design is the dining room your customers see. PHP is the kitchen behind it: unseen, but every meal depends on it. When someone fills in your contact form, searches your products or logs in, PHP is doing the work.
Most business owners use PHP without knowing it. WordPress, which powers a huge number of small business websites, is built on PHP. So are popular page builders like Elementor, and other systems such as Drupal and Joomla.
When and why PHP was created
PHP was created in 1994 by programmer Rasmus Lerdorf and released to the public in 1995. It started as a small set of tools to run his personal homepage, which is where the original name, Personal Home Page, came from.
It spread quickly for three simple reasons: it was free, it was easy to learn, and almost every web hosting company supported it. That made it the natural choice for the first generation of business websites, and later for WordPress.
We’ve been building websites since that same era, and we’ve watched PHP grow from a hobby tool into the engine behind much of the internet. That success is exactly why this week’s news matters.
Why PHP’s popularity has become a risk
PHP runs just under 70% of websites whose server-side language is known. When something that widespread has a flaw, a huge share of the internet is exposed at once.
Four things make the risk worse:
- Scale. Attackers love targets that work everywhere. One PHP flaw can open the door to millions of sites.
- Age. Parts of PHP’s code were written decades ago, before many of today’s security practices existed.
- Out-of-date websites. Many sites run old versions of PHP that nobody has updated in years.
- Limited resources. PHP is maintained by volunteers and a non-profit foundation, not a large company with a dedicated security army.
What AI found: the PHP2Shell flaws
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, let an attacker take control of a web server over the internet with no password or account. Both were rated 9.2 out of 10 for severity.
In simple terms, the problem is in how PHP tidies up its memory when a web request crashes part-way through. Under certain conditions, PHP leaves scraps of data behind. A later request can then read or tamper with those scraps.
That creates two serious risks:
- Data theft. Attackers could read leftover memory, which may hold passwords, login tokens and access keys.
- Full takeover. By chaining the flaws, attackers could run their own commands on the server, then steal data, plant malware or deface the website.
Three facts make this unusually serious:
- It’s in PHP itself. Your website’s own code can be perfectly secure and still be exposed. Researchers showed that even a basic “Hello World” page on an affected PHP version could be attacked.
- It goes back a long way. Every PHP version from the last decade is affected, back to version 5.4.
- It works on popular platforms. Researchers demonstrated working attacks on WordPress, Drupal and Joomla.
How AI found what humans missed
The faulty code had been sitting in PHP for over a decade. What changed this year was that AI made it practical to find the flaws and prove they could be exploited.
Two security firms found the problem independently in August. Calif used OpenAI’s GPT-5.6 Sol model. Wiz, owned by Google, used its own AI research tool, Wiz Atlas, together with Google’s Gemini 4 Argon and GPT-5.6 Sol.
Turning these flaws into a working attack meant chaining several bugs together and adjusting for different setups through endless testing. Wiz says that was close to the limit of what skilled human researchers could manage. With AI, a single researcher did in about a week what would previously have taken a top team months.
| Date (2026) | What happened |
|---|---|
| 19 August | Wiz finds the first PHP flaw using AI tools |
| 20–21 August | Remote attacks confirmed against Drupal, then WordPress |
| 24 August | Wiz reports the flaws to the PHP security team |
| 21 September | PHP begins work on a coordinated fix |
| 21 October | Patched versions of PHP released and the flaws made public |
The firms kept the details private until a fix was ready, which gave hosting companies and security providers time to prepare protection. That’s standard good practice, and it’s why the news broke on the same day as the patch.
The race to patch
Attackers moved fast. Within days of the announcement, Cloudflare’s chief executive said its network had seen millions of attempts to exploit the flaws, and Amazon spotted an exploit attempt even before the public announcement.
The US National Security Agency told organisations to apply the update straight away or take their servers offline. Some governments and large organisations chose to switch websites off while they patched.
The key point for small businesses: these attacks are automated. Attackers don’t pick targets by size or importance. Their tools scan the whole internet for any website running a vulnerable version of PHP, so a local plumber’s website is as likely to be hit as a big brand’s.
What small business owners should do now
The fix is a PHP update, and it usually sits with your web host rather than with you. Here’s what to do this week.
- Contact your web host or developer today. Ask them directly: “Has my server been updated to the patched PHP release from 21 October 2026?” Get a clear yes or no.
- Check your PHP version. Most hosting control panels show it. If your site runs an old version your host no longer updates, plan a move to a supported version now.
- Update WordPress, your theme and your plugins. This doesn’t fix the PHP flaw on its own, but it closes other doors attackers use.
- Check your backups. Make sure a recent backup exists and that someone has tested restoring it.
- Change important passwords once you’re patched. Because the flaws could expose passwords and access keys held in memory, it’s sensible to change admin and hosting passwords after the update.
- Watch for warning signs. Look out for admin users you don’t recognise, unfamiliar files, sudden slowdowns, repeated error pages or visitors being redirected elsewhere.
- Know who looks after your website. If you don’t know who manages your hosting and updates, find out today. That’s the person who needs to act.
The bigger picture: AI cuts both ways
PHP2Shell is a sign of things to come. The same AI tools that found these flaws can be used by attackers, and the PHP Foundation has warned that AI will make weaknesses like this easier to find.
The good news is that defenders have the same tools. AI is now being used to comb through old software and fix problems that have survived years of human checking. Expect more announcements like this one, across PHP and other long-standing software.
For business owners, the lesson is simple: a website isn’t something you build once and forget. Regular updates and maintenance are now as essential as locking your shop door at night.
Need help checking your website?
We updated all our hosting within six hours of the patch being released. We’ve been building and looking after websites for 30 years, and we’re here to help you stay safe without the jargon.
Not sure whether your website is protected? Get in touch for a free website check. We’ll confirm your PHP version, check your updates and backups, and tell you plainly what, if anything, needs doing. You can also try our free AI audit to see how AI tools can help your business work smarter and more securely.
Sources
- Wiz Research: PHP2Shell technical write-up
- CNBC: Why governments pulled websites offline over PHP
- CNN: Websites shut down globally after AI finds cybersecurity flaw
- Fortune: AI tools discovered the PHP vulnerability
- Al Jazeera: World leaders warn of security flaws found in PHP
- RTÉ: Websites go dark after AI-discovered flaw