AI as your IT director: one real security check, start to finish
PHP Vulnerability
In October 2026, security researchers announced two serious flaws in PHP, the software behind a majority of websites, including every WordPress site. Many business owners don’t know which of their websites and tools run on PHP, and that’s not something most people track.
So, I asked Claude, my AI assistant, one plain question:
“Explain any possible exposure I have to the PHP hacking vulnerabilities across all of my tools/platforms.”
That was my whole request. Here is what Claude checked, what it found and the commands you can run on your own computers.
What happened
October 21: PHP released fixes for two critical flaws, nicknamed “PHP2Shell.”
October 27: CISA, the U.S. cybersecurity agency, confirmed that attackers are exploiting those flaws.
November 3: I asked Claude to check every website, tool and computer I use.
PHP2Shell in plain English
PHP is the programming language a web server uses to build a page each time someone visits. Reports estimated that about 70% of websites run on it.
The two flaws (CVE-2026-109618 and CVE-2026-109619) are both rated 9.2 out of 10. An attacker with no login can send a specially built request to a website and run their own commands on the server. From there they can steal data, plant malware or deface the site. Reports also said AI tools helped researchers find the flaws, and that attackers are using AI to speed up their attacks, so patching quickly matters more now than it used to.
Why WordPress site owners should pay attention
The flaw is in PHP itself, not in WordPress, or a theme or a plugin. The attack can work before any WordPress code runs. So, updating WordPress and your plugins, which is still worth doing, does NOT fix this one, and a security plugin may never see the attack. PHP says no setting fully protects you. Updating PHP is the fix.
Who updates PHP depends on how your site is hosted:
Managed WordPress hosting: your host does it.
Shared hosting with a control panel: your host updates the server. You may also need to pick a newer PHP version in the control panel.
Your own server or cloud server: you or your IT person.
Website builders and online tools: the company that runs them.
To check your version in WordPress, go to Tools → Site Health → Info tab → Server. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or later in the same series. Versions 8.1 and older get no official fix, so a site on one of those needs to move to a newer PHP version.
If you’re not sure, send your host this email:
“Has PHP on my hosting been updated to the October 21, 2026, security releases (8.2.35, 8.3.36, 8.4.27 or 8.5.12), and were the PHP processes restarted afterward? Are your webmail and control panel updated too?”
All of that information about updating the PHP under the hood of your website has been shared in the news and across social media. I would not be surprised if you’ve seen it already. If not, hopefully, this helps you figure out if your digital footprint has PHP chewing gum stuck to it.
But the real point of this newsletter post comes next.
How Claude checked my business
I use Claude Code, a version of Claude that can open files and run commands on my computer when I allow it. I mentioned at the start of this post that I asked Claude one plain question:
“Explain any possible exposure I have to the PHP hacking vulnerabilities across all of my tools/platforms.”
Claude Code checked my setup directly instead of handing me a generic checklist to run down myself. Claude Code took six steps:
1) Read the news first. The flaw was newer than Claude’s training memory, so it searched for current reports instead of answering from memory.
2) Checked my computers. It looked for PHP installed on my Mac.
3) Searched my code. It checked all 19 of my software projects and found no PHP files.
4) Looked up my websites. It found which company hosts each of my web addresses.
5) Visited each homepage. It noted what each server reported about itself and what each programming language runs each page.
6) Checked my notes. It searched my notes for WordPress, PHP and hosting I might have forgotten.
What it found
Clear: my Mac and Windows computers have no PHP, and none of my 19 software projects use it.
The vendor’s job: two websites run on a website-builder platform, and my cloud tools are run by other companies. Those companies handle the updates.
Couldn’t see: one site sits behind a security service, so Claude couldn’t tell from outside. It said so instead of guessing.
Act: two placeholder (“coming soon”) web pages sit on shared PHP hosting. Nothing of mine runs there, but I emailed my host the question above. They responded within the hour to confirm that they updated PHP right away.
Check your own computers
PHP on a laptop or desktop is only a risk if it’s serving web pages, but it’s worth knowing whether it’s there.
Mac (Terminal): Open the Terminal app on your Mac and at the prompt, type this command (without the quotes):
“which php”
“php not found” means PHP is NOT installed on your Mac.
Windows (PowerShell): Open the Powershell app on your PC and at the prompt, type this command (without the quotes):
“php -v”
“not recognized” means PHP isn’t on the system path. Bundles like XAMPP install PHP in their own folder, where that check won’t find it, so run this at the Powershell prompt next (without the quotes):
“Test-Path C:\xampp, C:\wamp64, C:\wamp, C:\laragon”
Four “False” answers mean none of the common ones are installed. On both of my computers, every check came back clean. Phew!
Try this prompt
If another digital vulnerability lands in your news feed (it's just a matter of time), prompt your AI to help with that one too (works with Claude, ChatGPT, Gemini, Others):
“Here are the websites, tools and services my business uses: [your list]. Tell me which could be affected by [news story], show me how you checked and tell me what to do first.”
Not just an IT director
If you’re new to AI, the models you’ve heard about (Claude, ChatGPT, Gemini, etc.) can do more than you have considered thus far.
Before this PHP scrub, Claude helped me figure out why my desktop PC kept shutting down. It ruled out the memory and the hardware and traced the problem to a display driver. It saved me the expense and time of sending the PC to the manufacturer for diagnostics and repairs which could have been hundreds of dollars, weeks of time, and possibly ineffective. I’m typing this newsletter on that same machine, two months after Claude helped me troubleshoot the power issue.
Here are three more examples of jobs you may not think to delegate to an AI:
Prep for a prospect meeting. Claude researched a prospect before our meeting and caught a wrong fact in my notes: the company had been sold in 2021, not in 2026. It mapped who in the organization could say “yes”, ranked the AI ideas to test and wrote a checklist of questions for me to go through with the prospect. The detail was twice as good and twice the volume that I expected.
Audit my truck’s maintenance. Claude pulled years of service receipts from my notes archive, built a service log, and compared it to Ford’s schedule. It found no transmission fluid service and no spark plug replacement on record at 147,000 miles. Shame on me, but hooray for Claude!
A study partner for my daughter. I set up a Claude AI Agent for my daughter in college. It quizzes her, asks follow-up questions, and has her explain topics back. It never writes her assignments, and when she’s stuck, it drafts an email to her professor or a tutor asking for time to meet.
If you use an AI model like Claude, ChatGPT or Gemini, don’t hesitate to give it a problem to solve or a bunch of archive documents that you want sorted, even if you are skeptical about the results. Give it a chance to surprise you.
Now that’ll make you smile!
Sources:
1) CISA and researchers confirm exploitation (Cybersecurity Dive)
2) watchTowr CVE-2026-109618 FAQ
3) UK NCSC: Critical security issue affecting PHP
4) Help Net Security: PHP2Shell patched
5) Fortune: AI helped discover the PHP vulnerability
This article first went out by email in the Data Make You Smile Newsletter. Subscribe to get the next one by email.
