AI Just Found Two Critical Flaws in the Software Behind Most Websites. Here’s What to Ask Your Host Today.

On Wednesday, the PHP project released emergency fixes for two critical flaws that let an attacker run code on a web server without logging in. They are known as PHP2Shell, and both are rated 9.2 out of 10. PHP is the language behind WordPress, Drupal, Joomla, Magento, and a large share of the web, which means your business website may be affected even if you have never heard of PHP. Researchers used AI to find the flaws. If your site was built by an agency or runs on a hosting plan, one question matters today: has anyone confirmed in writing that PHP on your server has been patched?

What Happened

Security firms Calif and Wiz, along with an OpenAI researcher, found the flaws through OpenAI’s Patch the Planet program. Calif used GPT-5.6 Sol. The bugs had gone unnoticed for years and affect PHP versions going back to 5.4, released in 2012. Because the problem sits in PHP itself, one level below WordPress or any plugin, updating WordPress alone does not fix it. Researchers demonstrated working attacks against WordPress, Drupal, and Joomla.

The disclosure also went sideways. Details leaked a day early, which forced the PHP project to move its release up to Wednesday. The UK’s National Cyber Security Centre told organizations to update PHP systems immediately or take them offline until they could.

Is Anyone Actually Attacking Sites?

Reports differ, so here is both sides. Cloudflare reported early attack attempts on Wednesday morning, before the fix was even released, and Amazon says it saw an attempt as early as October 17. Other security firms report probing at scale. CISA said it had not observed exploitation when it published its alert, and Huntress had not confirmed successful attacks on the systems it monitors as of Wednesday afternoon. Nobody has shown how many sites were actually compromised.

The practical answer is to patch as if it is happening. The cost of checking is an email to your host. The cost of being wrong is a compromised site.

Why This Is a Marketing Problem

Your website is your storefront, your lead form, and the destination for every ad and post you publish. A hijacked server can leak customer data, redirect visitors, plant spam pages that damage your search ranking, or take the site down in the middle of a campaign. Your marketing spend all points at a server you may not control and have never checked.

Where the Patch Gap Is

PHP released fixed versions for 8.2 and newer. For 8.1 and older, the maintainers supplied minimal source patches, and many hosts and Linux vendors ship patched builds, but nobody is guaranteed to have done it yet. One analysis, citing WordPress.org statistics, put about 36 percent of WordPress sites on PHP 8.1 or older. That figure comes from a single source, so treat it as an estimate.

Hosts are moving at different speeds. As of Wednesday, GoDaddy said it had patched managed WordPress hosting but that customers on virtual private servers had to update PHP themselves, and several other hosts were still rolling out fixes on Thursday morning. Statuses change by the hour, so check your own provider’s page.

Five Questions to Ask Your Host or Developer Today

First, does my site run on PHP, and which version? If it is WordPress, Drupal, Joomla, or Magento, the answer is yes.

Second, has that version been patched for PHP2Shell, and on what date? Ask for this in writing. A vendor-patched build may not change the version number, so a date matters more than a number.

Third, who is responsible for patching? On managed hosting it is usually the host. On a virtual private server or a server run by an agency, it is usually you or them, and the answer should be a name, not a shrug.

Fourth, did anyone look for signs of compromise? If you run your own server, security guidance says to review logs going back to October 17.

Fifth, are backups current and stored somewhere a hacker on your server cannot reach? Take one before any update.

If your host cannot answer these clearly, that is information too.

What the AI Angle Means

AI found flaws that human reviewers had missed for years, and it found them in a few weeks. Attackers get the same tools and the same speed, and the gap between a fix going public and attacks starting keeps shrinking. This week, attacks reportedly began before the patch was out. Plan on the assumption that patching will need to be faster, routine, and someone’s explicit job.

The Honest Takeaway

This does not replace your host or developer, and the situation is moving quickly, so check your provider’s latest advisory before acting. But the habit is simple. Know what your website runs on, know who is responsible for updating it, and get confirmation in writing when something critical lands. A ten-minute email today is cheaper than any ad campaign you could lose to a hijacked site.

---

If you want to see how one shared component can expose thousands of businesses at once, this connects directly: 2,500 Companies Got Hit by One Bad Update. Here’s the AI Supply Chain Risk Nobody Is Watching.