AI Helped Find Two Critical Flaws in the Code Under Most Small-Business Websites: The 15-Minute Patch Check to Send Your Host Today
PHP, the code that runs WordPress and most small-business sites, shipped emergency fixes on October 21, and attack attempts started the same day. One email to your host confirms you are covered. Here it is.
What happened: On October 21, the PHP project released emergency fixes for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both can let an attacker run code on a web server without logging in. PHP sits under WordPress and a large share of the web. One of the research teams puts PHP at about 70% of all websites. Not every PHP site is exposed to these specific bugs, but researchers saw exploit attempts in the wild the same day the fix shipped.
Why AI is in the story: The flaws sat in PHP for years. The researchers say frontier models from Google and OpenAI helped find them and turn them into working attacks. That cuts both ways. The same tools that help defenders find holes shrink the time between a fix and an attack. Plan on days to patch, because attackers now work that fast.
The so-what for you: If your business has a WordPress site, a booking or payment plugin, a client portal, or an old landing page a past developer built, it probably runs on PHP. A hacked site can skim card numbers at checkout, send spam in your name, or send customers to a scam page. You do not need to touch code. You need one written answer from whoever hosts each site.
The 15-minute check:
- List every site. Main site, booking page, old promo sites, anything on a domain with your name on it. Log into your domain registrar to catch the ones you forgot.
- Find the host for each. Your monthly card charges or the registrar's settings will show it.
- Send the email below to each host or web person.
- Take dead sites offline. An old campaign site nobody updates is the easiest way in. If nobody owns it, ask the host to turn it off.
- Log the answers with the date, so you know which sites are confirmed.
Paste this into Claude or ChatGPT to draft the email:
I run a small business. Write a short, polite email to my web host or web developer asking them to confirm in writing:
1. Which PHP version each of my sites runs on.
2. Whether the October 21, 2026 PHP security fixes for CVE-2026-109618 and CVE-2026-109619 are applied. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
3. If any site runs a PHP version older than 8.2, whether they have applied a backported fix, and what an upgrade would cost.
4. The date the fix was applied.
My sites: [LIST YOUR DOMAINS]
Keep it under 150 words. Ask for a reply by [DATE].
When the replies come back, paste them in and ask: "Which of my sites is still unconfirmed or on a version older than 8.2? List those first."
Why ask in writing: Many hosts patch older versions without changing the version number, so the number alone proves little. A dated "yes, applied" from the host does.
What it's worth: Fifteen minutes and one email, against a checkout page that skims cards for weeks before anyone notices.
Keep it safe: Never send passwords or admin logins to confirm this. A real host does not need them. And if an email claiming to be your host arrives with a "patch now" link, log in to your host's site directly instead of clicking. Scammers ride big security news.