AI Found a PHP Flaw. Is Your Business Website at Risk?
On Wednesday morning, the PHP project shipped emergency fixes for two flaws that let a stranger run their own code on a web server without logging in. If your business website runs on WordPress, it runs on PHP, and this one lands on your plate whether you've heard of PHP or not.
Most small businesses around Springfield don't think of their website as a server. It's the thing a designer built a few years ago, the contact form that drops inquiries into someone's inbox, maybe a client intake page at a law office or an appointment request form at a dental practice. That page lives on a computer somewhere running PHP, and until someone confirms it's patched, it's an open question whether a stranger can take it over. For most businesses, one short email settles that question.
What PHP Patched, and Why the Number Is So Big
PHP is the programming language underneath WordPress, Drupal, Joomla, and a long list of client portals and booking tools. According to W3Techs, PHP powers roughly 70 percent of the websites whose server-side language can be identified. That's where the headline number in The Wall Street Journal's coverage comes from.
The PHP project's security advisory describes two critical bugs that can allow unauthenticated remote code execution. In plain terms, someone on the internet can send a crafted request to your site and make the server do what they want, no password required. The advisory says every PHP installation serving web requests is at risk, however PHP is connected to the web server, and the fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Once someone controls the server, everything the site touches is in play. That includes form submissions sitting in the database, the stored passwords and keys the site uses to talk to other services, and the pages your clients load. A taken-over site can quietly serve malware to the people who trust you enough to visit it.
The AI Part Changes the Clock
The Wall Street Journal reported that security researchers used AI tools to find these flaws. That's good news and bad news in the same sentence. The same kind of tool that finds a bug can help an attacker turn patch notes into a working attack. Patchstack, a security firm focused on WordPress, reported that some technical details leaked ahead of the planned disclosure and that it had confirmed exploitation incidents on the morning of the release.
A few years ago, a business owner could reasonably expect weeks between a big disclosure and widespread attacks. That window is shrinking toward hours. I wrote last month about how this year's AI-assisted breaches still leaned on the same old weak points, and this is the flip side of that story. The technology finding the holes is new. The fix is the same one it has always been: know what you're running, and patch it fast.
Who Has to Patch Your Website
If your site is on a hosted builder like Squarespace, Wix, or Shopify, you don't manage the server, so there's no PHP for you to update. The platform handles its own servers. Your only job is confirming you aren't also running an old WordPress site somewhere that everyone forgot about, which happens more often than you'd think after a rebrand or a website redesign.
If your site is WordPress on regular web hosting, your host updates PHP on its servers, but you usually control which PHP version your site uses through a setting in the hosting control panel. That setting is where trouble hides. Sites get pinned to an older version because a plugin broke during an upgrade years ago, and nobody ever moved it forward. The PHP advisory is blunt on this point: PHP 8.1 and older no longer receive updates from the PHP project. Some hosting vendors backport fixes on their own, so the only way to know is to ask.
That older group is not small. W3Techs data shows more than a third of PHP websites still run a version older than PHP 8, which means a lot of sites are waiting on someone else's backport.
If your site runs on a server your business owns or rents directly, such as a virtual server a former vendor set up, the patching is yours. The advisory notes that Linux distributions received the fixes in advance, so updated packages should already be waiting for whoever has the keys. If nobody knows who has the keys, that's the real finding.
Don't forget the PHP you don't think of as a website. Client portals, online intake forms, booking tools, and the internal web app a developer built for the office a decade ago may all run on PHP. Keeping a current list of every system like that, and who is responsible for patching it, is part of what a vCIO engagement covers. It's the list everyone wishes they had on a day like this.
The One Email to Send This Week
For most small businesses, the fastest path is a short message to your web host or whoever manages your site. Ask three things: which PHP version the site is running, whether that version includes the fixes for CVE-2026-109618 and CVE-2026-109619, and when they were applied. A good host will answer in a sentence or two. A vague answer is an answer too.
If the reply says you're on PHP 8.1 or older, treat the upgrade as overdue rather than optional. Moving a WordPress site to a current PHP version usually means updating or replacing a few plugins and testing the pages that matter, like contact forms and payment flows. It's a scoped project, and it's the kind of work our consulting engagements are built for.
If anything about the site has looked off lately, such as admin accounts you don't recognize, pages that redirect somewhere strange, or a warning from your host about unusual activity, assume the worst. Change every password tied to the site, including the WordPress admin logins, the hosting account, the database password, and any connected payment or email service keys. If you can't get a straight answer about patching, taking the site offline for a day or two is a reasonable call. The Wall Street Journal reported that some site operators are doing exactly that as a precaution.
And if the honest answer is that the site has been running on autopilot for years, consider whether it belongs on a hosted platform instead. Moving a small business site to Squarespace takes server patching off your list, which is a big part of why we build client sites there through our design services.
Frequently Asked Questions (FAQs)
Q: My website is on Squarespace. Do I need to do anything about the PHP vulnerability?
A: Not for the website itself. Squarespace runs and maintains its own servers, so there's no PHP version for you to update. Do check whether an older site, a client portal, or a booking tool tied to your business still runs on WordPress or other PHP software somewhere, since those still need someone to patch them.
Q: How can I tell what PHP version my WordPress site uses?
A: In the WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section, which lists the PHP version. Your hosting control panel usually shows it as well. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but hosts that use Linux distribution packages may show a different version number with the fix already included. When in doubt, ask your host to confirm in writing.
Q: Are the Macs and PCs in my office at risk from this?
A: Not directly. PHP runs on web servers, not on the computers your staff use to browse the web or answer email. The indirect risk is visiting a hacked website that has been rigged to serve malware, which is one more reason to keep browsers and operating systems current.
Q: Should I take my business website offline until I hear back from my host?
A: If your site collects client information through forms and you can't confirm it's patched within a day or so, a short outage is a reasonable trade. A day of downtime costs less than telling clients their intake details were stolen. Most sites on reputable hosting get patched quickly, so the email to your host usually settles it before it comes to that.
Send your web host one email this week asking which PHP version your site runs and whether it includes the fix. If the answer is 8.1 or older, or nobody knows who to ask, that's the problem to solve first.
Our Consulting service handles this kind of scoped job: tracking down who hosts what, confirming the patch is in place, and upgrading or moving a site that has fallen behind.
Tell us what your website runs on, or that you have no idea, through our contact page and we'll take it from there.
Further Reading
Related Articles
- What This Year's AI Breaches Mean for Your Small Business. Last month's look at AI-assisted attacks, and why the same basic defenses apply to this flaw.
- The Real Cost of "Free" IT Help for Small Businesses. Why the website a friend built years ago is often the one nobody can patch today.
- Windows 10 Security Updates Extended Again Through 2027. The same unsupported-software problem as PHP 8.1 and older, on the computers in your office.
Browse by Topic
About the author. Justin White is the founder of TechGents, an owner-operated IT consulting firm in Springfield, IL. He has nearly two decades of experience across Apple, Windows, and mixed-platform environments, helping small businesses and professionals across Sangamon County and Central Illinois run their technology without an internal IT department.