Artificial intelligence is helping developers solve problems faster, create useful tools, and improve online security. However, recent security research has highlighted another side of this technology: AI can help researchers uncover serious software vulnerabilities that may have remained hidden for years.

In October 2026, security researchers disclosed critical vulnerabilities in PHP, a programming language used by websites, content management systems, and web applications. The discovery triggered an urgent response from developers and security teams as organisations worked to protect affected servers.

The situation is an important reminder for anyone who manages a website. Whether you run a WordPress blog, an online store, a business website, or a custom PHP application, keeping your server software updated is an essential part of website security.

In this guide, we explain what happened, why the vulnerabilities matter, how AI helped identify them, and what website owners should do to reduce their risk.

What Happened in the PHP Security Incident?

On October 21, 2026, researchers at Wiz disclosed a set of serious vulnerabilities affecting the core PHP engine. According to the researchers, the flaws could potentially allow remote code execution or expose sensitive information under affected conditions.

Remote code execution is particularly serious because it may allow an attacker to make a vulnerable server run unauthorised commands. Depending on the server’s configuration and the attacker’s level of access, this could lead to data theft, website changes, malware installation, or further compromise.

PHP developers released security fixes following the disclosure and urged users to update affected versions. Security organisations also warned administrators to treat the issue seriously.

PHP powers a substantial portion of the internet, including websites built with WordPress, Drupal, and Joomla. However, this does not mean every website using PHP has been compromised. The actual risk depends on the PHP version, the specific vulnerability, server configuration, and whether the relevant fixes have been applied.

The most important step for website owners is to identify their installed PHP version and follow the official security guidance for their environment.

How Did Artificial Intelligence Help Discover the Vulnerabilities?

Finding a serious software vulnerability is not always straightforward. A flaw may exist in a small part of a program and remain unnoticed for years because it appears harmless during ordinary use.

Security researchers examine software behaviour, test unusual inputs, and investigate how different components interact. AI tools can help with some of this work by analysing code, exploring possible failure conditions, and helping researchers develop and test hypotheses.

In the PHP case, AI-assisted research helped uncover weaknesses in the core engine that researchers were able to investigate further.

1. Analysing complex software

Large software projects contain many functions, dependencies, and internal operations. AI can help researchers navigate this complexity and identify code paths that deserve closer examination.

This can make certain forms of security research faster, although findings still require careful technical validation.

2. Identifying unexpected behaviour

Software vulnerabilities sometimes occur when a program handles unusual inputs or memory operations incorrectly. AI-assisted analysis can help researchers explore these edge cases and identify behaviour that may lead to a security problem.

3. Helping test potential vulnerabilities

A suspected vulnerability must be tested to understand whether it is real, how it can be triggered, and what impact it could have. AI tools may help researchers reason through these questions and develop reproducible tests.

The discovery demonstrates the potential of AI-assisted security research. It also creates urgency because attackers may use similar techniques to study newly disclosed flaws and search for systems that have not yet been patched.

Why Are PHP Vulnerabilities a Serious Concern for Website Owners?

PHP is commonly used to process web requests, communicate with databases, manage user sessions, and generate dynamic website content.

When a vulnerability affects the PHP engine itself, the potential impact can extend beyond one WordPress theme or plugin. The underlying runtime may be used by many different applications on the same server.

Here are some of the main risks.

Website defacement

An attacker who gains sufficient access may modify website files, replace page content, or display unauthorised messages.

A compromised business website can lose customer trust and suffer reputational damage.

Data exposure

Web applications often process customer information, account details, contact forms, and other sensitive data. A successful attack may expose information that should remain private.

The actual data at risk depends on the application’s permissions and the attacker’s level of access.

Malware and malicious redirects

Attackers may attempt to insert harmful scripts into website files or redirect visitors to suspicious pages. In some cases, compromised websites can be used to distribute malware or conduct further attacks.

Server compromise

Remote code execution vulnerabilities can be especially dangerous when the affected service is reachable by an attacker and the necessary conditions are present.

If exploitation succeeds, an attacker may be able to run unauthorised code under the privileges available to the vulnerable process. Additional weaknesses could increase the impact.

Search engine and business damage

A hacked website may display spam, redirect visitors, or become unavailable while the owner investigates and restores it. These problems can affect customers, search visibility, advertising campaigns, and normal business operations.

Not every vulnerability leads to these outcomes, but the possible consequences explain why security updates should not be delayed.

Is Your WordPress Website at Risk?

WordPress uses PHP, so the PHP runtime installed on the hosting server is an important part of WordPress security.

However, updating WordPress itself does not necessarily update the PHP version used by the server. These are separate components and may need to be maintained independently.

If you manage a WordPress website, review the following areas.

Check your PHP version

Log in to your hosting control panel and find the PHP version assigned to your domain. Depending on your hosting provider, this option may appear under PHP settings, PHP selector, or a similar section.

You can also check the PHP version through authorised administrative tools.

Compare your installed version with the versions listed in the official PHP security advisory. Make sure the release you plan to use contains the relevant fixes and remains supported.

Update WordPress core

Install supported WordPress security updates after confirming compatibility and taking a backup.

Keeping WordPress current helps protect against vulnerabilities in the content management system itself, but it does not replace updates to PHP, plugins, themes, or server software.

Review plugins and themes

Remove plugins and themes that are no longer needed. Update maintained components through trusted sources, and investigate security advisories affecting software installed on your site.

An outdated plugin can introduce a separate security weakness even after the underlying PHP engine has been patched.

Ask your hosting provider for help

On managed hosting, the provider may control the available PHP versions or apply server-level patches.

If you cannot select a fixed version yourself, contact the hosting provider and ask whether the affected PHP release has been updated. For a production website, confirm the actual runtime version after the change.

How to Protect a PHP Website From Critical Vulnerabilities

Updating PHP is the immediate priority when an affected release is in use, but long-term protection requires several security practices working together.

1. Install the relevant PHP security update

Check the official PHP release information and security advisories to identify the corrected version for your branch.

Test updates on a staging environment when possible, particularly if your website depends on older applications or custom code. Once compatibility is confirmed, deploy the update promptly.

If you cannot patch an exposed and vulnerable service immediately, follow official guidance on temporary mitigations. Depending on the severity and your exposure, restricting access or temporarily taking the affected service offline may be necessary.

Do not assume that changing a website’s theme or updating a plugin fixes a vulnerability in the PHP engine.

2. Back up your website and database

Create a recent backup of website files and databases before making major changes. Store at least one backup separately from the production environment.

A good backup strategy should also include regular restoration tests. A backup that cannot be restored reliably may not help when a serious incident occurs.

3. Keep the operating system and web server updated

PHP is only one component of a web hosting environment. The operating system, web server, database, control panel, and supporting libraries also require maintenance.

Use supported software versions and apply security patches according to the risk and availability of fixes.

4. Apply least-privilege permissions

Website processes should have only the permissions needed to perform their tasks.

Avoid unnecessarily broad file permissions, shared administrative accounts, and excessive database privileges. If an application is compromised, limited permissions can help reduce the damage an attacker can cause.

5. Use a web application firewall where appropriate

A web application firewall can help filter suspicious HTTP requests and block some common attack patterns.

However, a firewall should be treated as an additional layer of defence, not a replacement for applying vendor security patches. A rule that blocks one attack pattern may not protect against every way of exploiting a vulnerability.

6. Monitor website and server logs

Review web server logs, authentication events, application logs, and hosting security alerts for suspicious activity.

Investigate unusual process execution, unexpected changes to website files, unfamiliar administrator accounts, and abnormal traffic patterns.

Keep in mind that the absence of obvious alerts does not prove a website is safe. Logging and monitoring are most useful when combined with patching and a clear response plan.

7. Secure administrative accounts

Use strong, unique passwords and multi-factor authentication wherever available. Restrict administrative access to trusted users and remove accounts that are no longer required.

Protect hosting control panels, SSH access, database credentials, and deployment systems as carefully as the website’s own login page.

8. Prepare for recovery

Document how to restore the site, rotate credentials, investigate suspicious activity, and contact your hosting provider.

If you find evidence of a compromise, do not simply reinstall a plugin and assume the problem is resolved. Investigate the affected files and accounts, remove unauthorised access, rotate exposed credentials, and restore from a known-clean backup where necessary.

What Should Plesk and cPanel Users Do?

If your website runs on Plesk, cPanel, or another hosting control panel, start by identifying the PHP version assigned to each domain.

A server can support multiple PHP versions, and different websites may use different runtimes. Updating one version does not automatically prove that every domain is using a patched release.

Follow this checklist:

• Identify every domain and application running PHP.

• Check the actual PHP version used by each website.

• Review official PHP security announcements for affected versions and fixes.

• Apply the appropriate update or request it from your hosting provider.

• Test important website functions after updating.

• Confirm that the site is running the expected version.

• Review logs and file changes if there are signs of suspicious activity.

• Keep a current backup and a documented recovery procedure.

For managed or shared hosting, do not assume you can update the server runtime yourself. Some settings are controlled by the hosting provider, and changing PHP versions without checking application compatibility can cause errors.

Can AI Help Defend Websites Against Cyberattacks?

Yes. AI can help security teams analyse large volumes of logs, identify unusual patterns, review source code, and prioritise potential vulnerabilities.

For example, an AI-assisted monitoring system may help an administrator investigate a sudden increase in suspicious requests or identify unusual activity associated with a user account.

AI can also help developers review code and understand potential security problems. However, automated findings can be inaccurate, and important decisions should be validated by qualified people and reliable security tools.

AI should complement established practices such as patch management, access control, secure development, monitoring, and tested backups. It should not be treated as a complete security solution.

What Does This Incident Mean for the Future of Cybersecurity?

The PHP incident illustrates how AI may change the pace of software security research.

Researchers can potentially discover and analyse some vulnerabilities faster than before. That is beneficial when findings are responsibly disclosed and fixes reach affected users quickly.

At the same time, public vulnerability information can help attackers understand what to look for. If a patch becomes available, systems that remain unupdated may become attractive targets.

This creates pressure on software developers, hosting companies, and website owners to shorten the time between discovering a vulnerability and deploying a fix.

For businesses, the lesson is practical: cybersecurity cannot be treated as a task that happens only after something goes wrong. Regular maintenance, asset tracking, timely updates, and incident preparation are essential parts of operating a reliable website.

Frequently Asked Questions

What is the PHP vulnerability discovered with AI assistance?

Security researchers disclosed critical flaws in the PHP engine in October 2026. Depending on the vulnerability and affected environment, the flaws could potentially expose sensitive information or enable remote code execution. Website owners should consult official PHP security advisories for the affected versions and fixes.

Does this mean 70% of websites have been hacked?

No. PHP is widely used across the web, but the fact that a technology powers many websites does not mean every website is vulnerable in the same way or has been compromised. Risk depends on the installed version, exposure, configuration, and whether security fixes have been applied.

Is WordPress affected by PHP security issues?

WordPress runs on PHP, so the PHP version on its hosting server matters. Administrators should check their runtime version and follow official guidance. Updating WordPress core alone may not update the server’s PHP engine.

How do I check my website’s PHP version?

Check the PHP settings in your hosting control panel or use an authorised server administration method. If your hosting provider manages PHP, ask them which version your domain uses and whether the relevant security updates have been applied.

Can a PHP vulnerability allow hackers to take over a server?

Some remote code execution vulnerabilities can allow unauthorised code to run when the required conditions are present. The impact depends on the affected software, configuration, and permissions. A potential vulnerability does not automatically mean every server can be taken over.

Is updating PHP enough to secure my website?

No. Updating PHP is important when a vulnerability affects your version, but you should also maintain WordPress or other application software, update plugins and themes, secure administrative accounts, review permissions, monitor logs, and keep reliable backups.

What should I do if I suspect my website has been hacked?

Contact your hosting provider or security team, preserve relevant logs, investigate suspicious changes, and follow a documented incident response process. Rotate potentially exposed credentials and restore from a known-clean backup if necessary. For serious incidents, seek qualified security assistance.

Final Thoughts

AI-assisted research has shown that even widely used software can contain serious weaknesses that remain undiscovered for years. The recent PHP security incident is a reminder that website security depends on ongoing maintenance, not just installing a security plugin and hoping for the best.

If you manage a WordPress site, business website, or custom PHP application, start by checking your PHP version and reviewing the official security guidance. Apply the relevant fixes, verify your configuration, and make sure your backups and recovery plans are ready.

AI may make vulnerability discovery faster, but timely updates and sensible security practices remain among the most effective ways to protect your website.