Prime Ai Solutions
Read time: 5 minutes
Leader, welcome back.
AI helped researchers find a serious flaw in PHP, the software behind about 70% of websites. The flaw has existed for over 10 years. Attackers tried to use it four days before the fix was released.
If you or your firm has a website, read this one.
LATEST NEWS
PHP2Shell: check your website today
What happened. PHP is the software that runs most websites, including any site built on WordPress, Drupal or Joomla.
On Wednesday, PHP released urgent fixes for two critical flaws, rated 9.2 out of 10. The flaws are known as PHP2Shell.
An attacker can use them to take control of the server that runs your website, without a password. They can also read data held in the server's memory, including passwords, login details and the keys that link your site to other systems.
Why it matters to you. Your website may hold more than you think: client portals, enquiry forms, booking systems, payment links and document uploads.
If an attacker gets in, you may have a data breach. Under UK GDPR, you may need to report it to the ICO within 72 hours. For law firms and accountants, it is also a breach of client confidentiality.
This is already happening.
Amazon recorded an attack attempt on 17 October, four days before the flaws were made public. Now that the fix is public, attackers can study it to work out where unfixed sites are weak.
That is why the next few days matter most.
The UK's National Cyber Security Centre (NCSC) advises taking offline any system you can't fix quickly. Finland and the Netherlands took some government sites offline. Edinburgh council and the BBC pulled pages too.
What to do. Find out who manages your website and send them the email in Steal This below. You need one clear answer: is our site on a fixed version?
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Sites on PHP 8.1 or older no longer get fixes, so they need upgrading.
If your site runs on Squarespace, Wix or Shopify, the provider manages this for you. Check their status page.
My take. The most important part is how the flaw was found. The weakness had been known about for years, but it was seen as too complicated for hackers to use, so it was left alone. AI changed that. Wiz, the Google-owned security firm behind the research, says one researcher using AI did in a week what used to take a team of experts months. Its co-founder, Ami Luttwak, called it "the most severe AI vulnerability that was ever found."
AI now finds weaknesses faster than people can fix them
What happened. Reuters reported that one hacker used AI agents to break into the websites of more than 100 companies, at a cost of a few thousand dollars. In the same week, Bank of America hired 1,000 extra contractors to fix weaknesses that AI found in its systems. They join 3,000 staff already doing this work.
Why it matters to you. Hacking used to take time and skill, so attackers focused on large targets. AI has made attacks cheap and fast, so smaller firms are now targets too.
If Bank of America can't fix problems as fast as AI finds them, a small IT supplier won't either.
What to do. Ask your IT provider one question: "How long does it take you to apply a security fix after it is released?" Days is good. Weeks is a risk.
If they don't know, that is a problem.
STEAL THIS (PUN INTENDED!)
The email to send your web provider today
Copy this email, fill in the gaps and send it to whoever manages your website today.
Subject: PHP2Shell: please confirm our website is fixed
Hi [name],
PHP released fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) on 21 October. Please could you confirm the following by [day]:
1. Which of our websites and systems use PHP? Please include client portals, booking or payment pages, and any old sites still online.
2. Which PHP version is each one using now?
3. Have they been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35? If not, when will they be?
4. For anything on PHP 8.1 or older: what is the plan, and should we take it offline until it is fixed?
5. Have you checked whether anyone accessed our systems before the fix?
Thanks,
[your name]When you get a reply, paste it into ChatGPT or Claude with this prompt:
You are a cyber security adviser to a small professional services firm. Below is our web provider's reply about the PHP2Shell vulnerabilities. For each of the 5 questions I asked, say whether it was answered clearly, answered vaguely, or not answered. Then write the follow-up questions I should send. Use plain English.
[paste reply]Follow up on any vague answers. "We keep everything up to date" does not tell you the version number.
Do not paste passwords, server details or client data into an AI tool.
SIGNAL / NOISE
Signal: Microsoft is adding controls to Microsoft 365 that rate the risk of each AI agent. Admins can block an agent from making changes, require human approval, or switch it off.
Why it matters: most firms run on Microsoft, and staff are already setting up agents. Ask your IT team who can create agents in your system and who approves what they do.Signal: ChatGPT can now use the tabs you have open in Chrome, and fill in forms or download files for you.
Why it matters: if a client file or your banking portal is open in another tab, the AI can see it. Close sensitive tabs before you let it act for you.Signal: Anthropic is still hiring technical staff, but junior roles fell from 27% to 9% of new hires.
Why it matters: last week we covered how AI can stop juniors learning. Fewer junior roles means fewer people trained to check AI's work in five years' time.Noise: OpenAI is trying to raise money at a reported $1.4 trillion valuation before Anthropic lists on the stock market.
It changes nothing about how your team works.
Attackers and defenders are both using AI. The same tools that found PHP2Shell helped fix it before most people knew about it. The firms that stay safe will be the ones that check early.
One question for you: did your web provider tell you about this, or is this the first you've heard of it?
One more thing.
You saw the junior hiring numbers above. Junior roles are shrinking and senior people are stretched.
I’m building a new platform to help juniors and seniors grow, and to help companies find the best talent.
Want early access? Reply “platform”. I read every reply.
-Umar Prime AI | primeai.solutions
