AI helped find the PHP flaw. Here’s what that means for your business

This week’s critical PHP flaw is the first big security story of the AI era. Researchers used AI to find it. When the details leaked, the BBC’s cyber correspondent said criminals had something usable within about half a day. For a small business the lesson is simple: the gap between a flaw being found and it being used against you is shrinking, so the basics of keeping systems up to date matter more than ever.

What happened

On 21 October 2026 the PHP project released fixes for two critical flaws in PHP, the software that runs most small business websites, including WordPress. Attackers could use them to take over a web server without logging in. Details leaked before the planned release, and organisations around the world, including the UK government, took websites offline while fixes went in.

If your website runs on WordPress or another PHP system, check that first. Our sister company AlphaSec has a guide to checking whether you’re affected, with an email you can send to your host.

How AI found it

According to the BBC, PHP’s developers had known about a possible weakness since 2024, but couldn’t work out how anyone would actually use it in an attack. AI changed that. Researchers using frontier AI models, including an OpenAI project that uses AI to find and fix security flaws, turned up two serious flaws that could be exploited in practice. A researcher who helped identify them told the BBC it was the most serious vulnerability he had ever found. The National Cyber Security Centre (NCSC) was briefed by OpenAI the week before the fixes came out.

The government has been doing the same on its own systems. AI minister Kanishka Narayan told the BBC that an AI model, which cost £13,000 to use, had found 500 new vulnerabilities in significant areas of the public sector.

The catch: attackers use AI too

The BBC’s Joe Tidy compared this with a major flaw in 2021, when it took criminals 15 days to start exploiting it. This time, he said, they had something usable in about half a day. Security firms reported attack attempts even before the fix was public. The NCSC’s chief technology officer, Olly Whitehouse, said it was “reasonable to expect that this will not be the last”.

What it means for a small business

• The time you have to patch is shrinking. “We’ll update it next month” used to be a manageable risk for many small firms. When attacks arrive within hours of a flaw going public, automatic updates and suppliers who patch quickly matter more than ever.
• Know what you run. The NCSC’s first instruction this week was to identify every system running PHP. Most small firms couldn’t produce that list quickly. A simple record of your systems, who supplies each one and who keeps it updated turns the next alert into a phone call rather than a scramble.
• Fewer moving parts means less to patch. A website built as ready-made pages, with no PHP, database or plugins behind it, gives a flaw like this nothing to attack. This website is built that way, and none of the Alphabyte Group’s websites were affected.
• AI helps defenders too. The same technology found this flaw before most attackers did. It’s useful for jobs like summarising security alerts or checking what software you run, but it doesn’t replace the fundamentals: updates, backups and multi-factor sign-in.

Getting help

We build AI automations rather than websites, but the right people for this are in the same group. Alphabyte IT looks after IT and updates for businesses across South Wales, AlphaSec can check your website from the outside for free, and AlphaPixel builds websites with nothing to patch.