7 min read
“No model is simply capable of unearthing ‘all bugs’ with simple prompts.” That line comes from Calif, the security firm that found the two web bugs everyone spent last week patching, and it is a useful reminder: AI helped turn an old discovery into a working attack, but the fix still comes down to ordinary people doing ordinary maintenance. If your business website runs on WordPress, this week that ordinary person is you.
Here is a calm, step-by-step checklist for a solo owner who is not a developer. Set aside about 30 minutes, and use an AI assistant to help with the parts that feel technical.
What PHP2Shell is, in plain English
PHP is the programming language that WordPress, and a huge share of the web, is built on. According to TechCrunch’s reporting on the bugs, around 70% of the web-facing internet relies on it. On October 21, 2026, the PHP Foundation disclosed two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 (a CVE is simply a public ID number for a known security hole), and released patches the same day (the official release notes are on the PHP news archive). The US cybersecurity agency CISA issued an alert alongside them.
The reason this one matters: the bugs allow remote code execution without a password, which means a stranger on the internet could run their own commands on your web server without logging in and without you clicking anything. Amazon spotted attacks about a week before the patches came out, so defenders were told to look for trouble going back to October 17.
The good news is that WordPress itself does not need a special plugin update for this. The fix lives one layer below, in the PHP software your hosting company runs. Your job is to confirm that layer has been updated, then check that nothing slipped in before it was.
Step 1: Figure out who is responsible for your PHP
This single question decides how much of the work is yours.
- Managed WordPress hosting (the kind where you never see a server, only a dashboard): your host updates PHP for you. Your job is to confirm they did.
- Shared hosting with a control panel such as cPanel: the host usually patches PHP, but you may pick the PHP version yourself in a “Select PHP Version” or “MultiPHP” screen.
- Your own server or VPS (a virtual private server you or a freelancer set up): nobody is patching it unless someone runs the updates. Treat this as urgent.
Not sure which you have? Look at your last hosting invoice. If it says “managed WordPress,” you are in the first group.
Step 2: Read your PHP version without touching any code
In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, then Server. You will see a line called “PHP version.” Copy that number somewhere. You do not need to interpret it yourself; you will hand it to your host in the next step.
Step 3: Ask your host one direct question (let AI write the email)
Most hosts published a status note last week, so check their status page or blog first. If you cannot find a clear answer, send a short support message. Here is a prompt you can paste into ChatGPT, Claude, or Gemini:
“Write a short, polite support ticket to my web host. My WordPress site is [domain]. Site Health shows PHP version [number]. Ask them to confirm in writing whether my server has the PHP Foundation patches released October 21, 2026 for CVE-2026-109618 and CVE-2026-109619, and whether they saw any signs of exploitation on my account since October 17.”
Ask for a written yes or no. “We take security seriously” is not an answer. Save their reply with your business records.
If you run your own server, the prompt changes: ask the AI to explain, for your exact setup (for example Ubuntu with a specific PHP version), how to install the latest PHP security updates and restart the web server. Then check its instructions against your provider’s documentation before running anything. AI assistants can and do invent commands, which is why our beginner’s guide to AI hallucinations recommends verifying anything you are about to act on.
Step 4: Look for anything that moved in since October 17
Patching closes the door. It does not tell you whether someone walked in first. Spend ten minutes on these checks:
- Users: open Users, then All Users, and sort by role. Any administrator you do not recognize is a red flag.
- Plugins: look for plugins you never installed, especially ones with vague names or no description.
- Recent changes: if your host offers a file manager, look for recently modified files in the main folder, dated from October 17 onward, that you did not change.
- A free scan: a security plugin such as Wordfence or Sucuri’s free scanner can compare your core files against clean copies and flag differences.
- Your site in a private window: visit your homepage and contact page while logged out. Unexpected redirects or strange pop-ups are a classic sign of tampering.
If something looks off, stop and contact your host before deleting anything. Many hosts will restore a clean backup from before October 17 for free during an event like this.
Step 5: Use AI to read the scary parts, carefully
Security scan results and server logs are written for engineers. This is where an assistant genuinely helps. Paste a scan summary into your chatbot and ask: “Explain each warning in plain English, rank them by urgency, and tell me which ones I should ask my host about.”
Two rules keep this safe:
- Remove secrets before pasting. Delete passwords, database names, API keys, and customer email addresses from anything you share.
- Treat the answer as a translation, not a verdict. The AI can tell you what a warning means. Only your host or a security professional can confirm whether your site is actually compromised.
Step 6: Change the keys, even if everything looks clean
Because attacks started before anyone knew about the bugs, it is worth rotating your credentials as a precaution:
- Your WordPress admin password, and those of anyone else with an account.
- Application passwords (found under Users, then Profile), which tools and automations use to post to your site. Revoke any you no longer use.
- Your hosting account password and, if you have one, your FTP or SFTP password.
- Any API keys stored in plugins, such as payment, email marketing, or AI writing plugins.
Turn on two-factor login for your hosting account while you are there. It takes five minutes and blocks the most common follow-up attack.
Step 7: Make sure the next one is boring
PHP2Shell will not be the last big web bug, and AI is making it faster for attackers to turn known flaws into working exploits. A few habits turn the next emergency into a non-event:
- Automatic daily backups stored somewhere other than your server, with at least two weeks of history.
- Automatic minor updates for WordPress core and trusted plugins.
- A one-line security section in your AI policy, covering what may and may not be pasted into chatbots. Our one-page AI policy quick wins show how to write it in an afternoon.
- A saved prompt that turns any security headline into “what does this mean for my site, and what do I ask my host?”
Your website is your storefront, and increasingly it is also what AI assistants read when customers ask them for a recommendation. A hacked site can quietly drop out of those answers. That is one more reason to keep it healthy, as we covered in how a solo owner gets recommended by AI.
Your 30-minute recap
Check your PHP version in Site Health. Get a written yes from your host about the October 21 patches. Look for new admin users, unknown plugins, and odd redirects since October 17. Rotate your passwords and application passwords. Turn on backups and two-factor login. Done.
Have you already heard back from your host? Tell us in the comments how quickly they answered and what they said. It will help other solo owners know what a good answer looks like.
