On October 21, 2026, OpenAI said its models helped researchers find critical security flaws in PHP, as part of an effort it calls Patch the Planet. PHP is the code that builds a lot of web pages on the spot every time someone clicks: shop pages, booking pages, client portals, blogs. The flaws were not in one add-on. They were in the engine underneath.
For about two months before going public, OpenAI says it led a group of PHP maintainers, researchers and security firms that built the fixes quietly. That is how you keep attackers from getting a head start. The tech press noticed fast. TechCrunch called it "PHP Armageddon," and reported that Google's Wiz has been finding old holes too.
Since the video: news reports, including Fortune citing AWS and Cloudflare, say attackers started trying this flaw within hours of the disclosure. It is being called PHP2Shell. That makes "this week" the right deadline, not "someday." PHP's own advisory lists the fixed releases.
If your website takes orders, bookings or logins, it holds your customers' names, addresses and orders, plus your own sales. A hole in the engine puts all of that on the table. And here is the twist: the same kind of AI that found these holes can help attackers find the sites that never patched. Now that the fixes are public, the race is on.
Picture a small candle shop on cheap shared hosting, run by someone who is not a developer. This is an illustrative example, but the steps are the same for most small sites.
1. Find your PHP version. Log in to your hosting panel and open the PHP settings. You will see the version your site runs on, and usually a list of newer ones on offer.
2. Run the free checker, or ask for help. OpenAI published a free checker on GitHub, openai/php2shell-checker, packaged as a Codex skill. If you use Codex, you can ask it to run the check for you instead of reading code.
3. Back up first. Most hosts put a one-click backup in the same panel. If the upgrade goes wrong, you can put the site back.
4. Upgrade PHP. Pick the newest PHP version your host offers and save. For most small sites, that one setting is the whole upgrade. Then run the check again.
5. Test the money. Place a test order, send a contact form message and make a test booking. If all three go through, your customers will never notice a thing.
If something breaks, it is usually an old plugin or theme that doesn't like the new PHP. Update it, or ask your host for help. Don't roll back to the old version to make the problem go away.
Ask your AI to draft a short message to your host or web person with three questions: which PHP version is my site on, is it patched for this month's PHP flaws, and when can you upgrade it? That one email covers you even if you never open the hosting panel.
Our answer: safer, but only if you update this week. The sites that wait are exactly the ones attackers will go looking for. Three habits keep you ahead next time. Know your version, with a monthly calendar reminder to check it. Turn on updates for plugins and themes, and ask your host whether they move you to new PHP versions or wait for you. And after every update, test the money.
AI is now finding security holes faster than ever, for defenders and attackers alike. The owners who come out fine are the ones with a simple routine and an AI that already knows how their business runs, so a note to the host or a checklist takes two minutes instead of an afternoon. If you want that kind of setup, start with why AI needs a second brain to be useful.
Join the free KiS Skool community. Ask questions, get unstuck, and learn AI alongside other beginners.
Join the free SkoolPrefer to watch? Watch on YouTube