The bug was over a decade old. AI found it.
Two critical flaws sat unnoticed for more than ten years in the software behind most of the web. This summer researchers used AI to find them, and by late October they were being used in real attacks. Here's what that means for a small business website, and the questions to ask this week.
Most small business owners have never heard of PHP. It is the programming language that runs behind roughly 70% of websites, so the odds are good that it has been running yours for years.
On 21 October the people who maintain it released emergency fixes for two critical flaws in it. The fixes came out a day early, because details had leaked. The flaws let an attacker run their own code on a website’s server without logging in, which means taking the server over. Five days later the US government’s cyber security agency confirmed the flaws were being used in real attacks. It gave federal agencies until 29 October to fix them.
The flaws had been sitting in PHP for more than a decade. This summer two separate research teams found them with the help of AI, and showed they could be turned into working attacks.
What actually changed
Old bugs in old software are nothing new. What’s new is how quickly they now get found and used.
Until recently, turning a subtle flaw into an attack that worked took a rare expert a long time, which made it expensive. That cost was a large part of what kept most websites safe. Attackers went after the cheap targets, and most small businesses got through on not being worth the bother.
That is the part AI is eroding. A computer science professor at Columbia University put it in one sentence to Fortune:
“AI is making the old vulnerabilities cheaper to discover and exploit.”
And in another:
“Humans don’t work at the speed of AI. That is the asymmetry right now.”
The researchers themselves were careful not to oversell it. One of the teams said most of the work still depended on what its own people already knew, and added: “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.”
At least for now is the part to plan around. Attacks on old flaws are getting cheaper, so being too small to bother with protects you less every year. Updates now have to happen in days, not whenever someone gets round to them.
The question most owners can’t answer
Fixing this means updating PHP wherever it runs. Many hosting companies do that for their customers, but not all of them do it quickly. Some sites run on an old version the project no longer maintains, and anything before version 8.2 is not getting this fix from the project at all.
Days after the fixes came out, security researchers were still counting millions of servers on the internet running affected versions.
The question for a small business isn’t technical. It’s this: who is responsible for updating the software my website runs on, and did they do it in the last two weeks?
For a lot of businesses the honest answer is “I don’t know”. Maybe the site was built by a nephew, a freelancer who has since moved on, or an agency you stopped paying three years ago. It’s on a hosting plan you renew without reading the email. There’s a plugin for the booking widget, another for the gallery, and a contact form nobody has touched since it was installed.
None of that was a problem while attacks were expensive. With old flaws now cheap to find, an unmaintained website is a liability.
The fair question
devkoi is a website builder. Isn’t this just a pitch to switch?
Partly, and it’s worth being straight about which part.
A devkoi site is built ahead of time into plain files and served as files. When someone visits, no PHP or other program runs on a server to work out what to show them, so this particular kind of flaw has nothing to attach to. There is no server software of yours to update, because none is running.
But that does not make a site unhackable, and it’s not the whole picture:
- Your logins are still the way in. The account where your web address is registered, and your business email, matter more than the site itself. Someone who gets into either can redirect your site or reset everything else.
- A contact form is a separate system. On a devkoi site it either opens an email to you or sends to an outside form service. That service has its own security, which devkoi does not control.
- devkoi can’t check your current website. It doesn’t scan or update sites hosted anywhere else, and it can’t tell you whether yours was affected.
- Plain files can’t do everything. devkoi doesn’t build shops, booking systems, payments or customer logins. If you need those, you need software that someone keeps updated. That’s fine, as long as you know who that someone is.
What to do this week
1. Ask your hosting company one question. You don’t need to understand the answer in detail. You need a yes or no, and a date.
“Has the PHP on my website been updated for the PHP2Shell fixes released on 21 October? Which version is it on now?”
2. If someone else built or looks after your site, ask them too. Hosts update their own servers, but plugins, add-ons and old site versions are often left to whoever built the site.
“Is everything on our website up to date after the October PHP fixes, including the plugins? When did you last check?”
If nobody answers, you have also learned something.
3. Find the websites you forgot about. The old address from before the rebrand, a test copy, the page for a promotion two summers ago. If it’s still online it’s still running, and nobody is updating it. List every web address you pay for and check what each one actually shows.
4. Remove what you don’t use. Every plugin and add-on is more software someone has to keep updated. The ones you stopped using years ago don’t get looked at, so they’re the riskiest part of the site. If a feature isn’t earning its place, take it out.
5. Decide what your website actually needs to do. Most small business sites exist to say who you are, what you do, what it costs and how to reach you. None of that needs software running on a server. If that describes yours, you can rebuild it as a devkoi site by describing it in a chat, check the preview, and publish when you’re happy. Building is free, and putting it on your own web address is part of the paid plans.
“Rebuild my current website as plain pages: same services, prices, opening hours and contact details.”
6. Lock the doors that remain. Turn on two-step sign-in for the account that holds your web address and for your business email. This step matters whichever way you build your site, and it takes ten minutes.
The flaws found this summer were never the real problem. Old software is full of them, and more will turn up. What’s changed is that finding and using them now takes weeks instead of years.
Nobody can make a website perfectly safe. What you can do is know who keeps it updated, run less software, and make sure every part of it has someone looking after it.