Last week, AI helped uncover a flaw in the software behind most of the world's websites, and attackers were using it within hours. If your business has a website, this one is worth five minutes of your time.
You may have seen the headlines. Finland took every public government website offline. The Netherlands, Denmark and France took sites down too. The US National Security Agency told organizations that could not fix the problem right away to switch their websites off until they could.
The cause was a flaw called PHP2Shell, in a piece of software most business owners have never heard of but almost certainly depend on. It has been fixed. But the way it unfolded tells you a lot about the next few years of running a business online, and what you should expect from whoever looks after your website.
What PHP is, and why it is on your website
PHP is the engine that builds web pages on the fly. Every WordPress site runs on it, as do Drupal, Joomla, most online stores built on WooCommerce, and countless booking forms, customer portals and member areas. If your website has a login, a dashboard or a page builder, there is a good chance PHP is underneath.
How much of the web
Share of websites with a known server language that run on PHP
Every WordPress site is in the red bar.
The flaw let an attacker take control of the server behind a website without a password or a login. Every version of PHP from the last fourteen years was affected. In practice, that meant most of the websites on the internet, until they were updated.
What was at stake for a business
When someone controls the server your website runs on, they control everything on it. For a business, that can mean:
- Customer data. Names, emails, phone numbers, order history, and anything your forms collect.
- Payments. Hidden code on a checkout page can copy card details as customers type them.
- Your reputation. Spam pages, fake redirects or a defaced homepage, often noticed by customers before you.
- Google. Hacked sites get flagged with a warning in search results, and traffic drops overnight.
- Downtime. A site taken offline to clean up is a site that is not taking bookings, orders or calls.
- The rest of your business. A hacked server can be used as a way into email, files and other systems.
Why this is an AI story
Part of the flaw was not new. A PHP developer noticed it during a review in 2024. It was set aside because nobody could show it was dangerous.
In August 2026, AI showed it was. A researcher at the security firm Calif, working in an OpenAI program called Patch the Planet, found the first part with an OpenAI model on August 1. Researchers at Wiz found it on their own on August 19, also with AI tools. Both reported it privately, so it could be fixed before criminals knew about it.
Timeline
From discovery to millions of attacks
| Aug 1 | Found with the help of an AI model |
| Aug 19 | Found again, separately, also with AI |
| Oct 17 | First attack attempts, before any announcement |
| Oct 20 | News leaks, a day before the fix |
| Oct 21 | Fix released. Millions of attacks by evening. |
The plan to fix it quietly did not hold. News leaked the day before the fix was ready, and Amazon later said it had seen attack attempts days earlier still. Once the details were out, attacks did not build slowly. They exploded.
Attack speed
Attack attempts Cloudflare counted after the news spread on October 21
Each step is about ten times the last, so the bars are drawn on a scale of ten.
That speed is the AI part. The same tools that help researchers find a flaw help criminals turn it into a working attack and aim it at millions of websites at once. As TJ Sayers of the Center for Internet Security put it, PHP2Shell "shows how AI can help uncover buried flaws and turn complex exploit chains into practical attacks."
The real lesson: the waiting period is gone
Most businesses have quietly relied on a waiting period. A flaw would be announced, and it took criminals days or weeks to use it widely. Updates could wait for the next maintenance visit, or for whenever someone got around to them.
The window to update
Time between a flaw becoming public and widespread attacks
Illustration, not to exact scale. For some sites, attacks started before the news broke.
PHP2Shell shrank that window to hours, and for some websites the attacks started before the news broke. The good news is that the people defending the internet found this flaw first. The bad news is that there is a lot of old, widely used software that has never been examined this closely, and now it can be. PHP2Shell will not be the last of these. It is more likely the first of many.
How a serious business should take it
None of this calls for panic, or for you to become a technical expert. It calls for treating your website like the business system it is: something with an owner, a plan and a response time. These are the five things we would want every business owner to have in place.
- A named person who keeps it updated. Your web company, your host, or someone on staff. Not "whoever built it", and not nobody.
- Critical fixes applied the same day. Ask how fast they act on an emergency like this one. The right answer is in hours.
- A plan to take the site offline. Who decides, and a simple "back soon" page ready to go, so it takes minutes instead of a meeting.
- Backups kept somewhere else, and tested. A backup you have never restored is a hope, not a plan.
- A firewall in front of the site. Services like Cloudflare blocked many PHP2Shell attacks before most sites were even updated.
Five questions to ask whoever runs your website
Send these this week. The answers will tell you quickly whether you are covered.
- Was our site affected by PHP2Shell, and is it updated now? A good provider will already have told you.
- Which PHP version is our site running right now? It should be 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Anything on 8.1 or older did not get an official fix and needs an upgrade.
- Did you check for signs someone got in before the update? An update locks the door; it does not remove anyone already inside.
- Do we have old test sites or unused plugins online? Forgotten copies of a website are often the ones nobody updates.
- How fast will you act on the next one? There will be a next one.
What we did
On our main hosting server, we updated PHP to the fixed versions and confirmed the fixed versions are the ones actually running, not only installed. That last step matters: a server can have the new version on disk while the old one keeps serving visitors until it restarts. Our own site, hixfi.com, no longer runs PHP at all since we moved it off WordPress the week before.
Questions business owners ask
Is my WordPress site affected by PHP2Shell?
Every WordPress site runs on PHP, so it was affected until its PHP was updated to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later. WordPress itself does not need an update for this; the PHP underneath does.
My website is hosted by a company. Do I need to do anything?
Confirm it. Most hosts updated quickly, but sites on older PHP versions did not get an official fix. Ask your host which PHP version your site runs right now.
What if my site cannot be updated right away?
Security agencies advised taking the site offline until it can be. A firewall helps, but the PHP team said no workaround is complete.
How would I know if my site was hacked?
Warning signs include admin users nobody created, pages or links you did not add, a Google warning in search results, or customers reporting odd redirects. If in doubt, have a professional review it.
Not sure where your site stands?
Our website care plans include same-day security updates, off-site backups and monitoring, so emergencies like this one are handled before you hear about them.
Or get in touch and we will check your site for you.
Want this handled for you? See our WordPress maintenance plans.
