When the PHP2Shell headlines hit, we checked our own setup first. None of our sites run PHP, so there was nothing to patch. What stuck with us was how the flaw was found, because it says a lot about where website security is headed for small businesses, not just big companies.
How was PHP2Shell found?
According to Wiz Research, which found it, the first bug turned up on August 19, 2026. Within two days the team had a working attack against Drupal and then against WordPress, without needing a login. Wiz reported the flaws to the PHP project on August 24, and fixed versions came out on October 21. Wiz says it used AI models throughout, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and credits Gemini with an important part of finding the bug. Wiz also says every PHP version from the last decade has at least one of the flaws, and other reports trace them back to PHP 5.4. (Source: Wiz Research.)
Why does it matter that AI helped find it?
Wiz writes that AI helped it build and adapt working attacks across several applications within hours, and that one researcher finished in a week what used to take a top team months. That is Wiz's own description of its work, not an independent measurement. But if it's even partly right, finding serious holes in widely used software is getting faster and cheaper, and those tools are just as available to people looking to break in as to people looking for holes to fix.
What happened between the leak and the patch?
Details of the flaws leaked on October 20, after a post on Hacker News said they were about to go public. The post came down, but screenshots spread. PHP moved its security release up a day. Cloudflare reported early attempts to exploit the flaws before the patch was out, and said attackers changed their payloads to get past its firewall rules. So for about a day, the flaws were public and there was no official fix to install. (Sources: Huntress, The Hacker News.)
Does this mean small business websites are being targeted?
Not the way most people picture it. Nobody sits down and decides to hack a roofing company in Toms River. Automated scanners sweep huge ranges of the internet looking for anything running a vulnerable version, and they hit big and small sites alike. Being small doesn't hide you. What protects you is being patched before the scanner shows up, and that comes down to who is responsible for your site and how quickly they act.
Who is actually responsible for my website's security?
Usually three different people, and it's easy to lose track of one. Your hosting company handles the server software, including PHP. Whoever manages the site handles WordPress, the theme and the plugins. You, or someone you trust, handle the logins: the company you bought your web address from, the hosting account and the email tied to them. If one of those has no name next to it, that's where the risk is. A common version is a WordPress site built years ago by someone who has since moved on, on a hosting plan the owner pays for but never logs into.
I saw a scary tech headline. How do I tell if it affects my business?
Start by knowing three facts about your website: what it's built on, who hosts it, and who updates it. If you don't know what it's built on, add /wp-admin to your web address and see if a WordPress login appears. Then ask an AI assistant a specific question, not a general one. "My site is WordPress on GoDaddy shared hosting. Does PHP2Shell affect me, and what should I ask my host?" gets a far more useful answer than "is PHP dangerous?" Then take that question to your host and get their answer in writing. AI is good for figuring out what to ask. Your host is the one who knows whether your server is patched.
What makes a website less exposed to the next one of these?
Less software on the server, and someone clearly in charge of what's left. A static HTML site has no PHP, no database and no plugins running on a server, so flaws like PHP2Shell don't apply to it at all. It still has accounts that need strong passwords and two-factor login, so it isn't risk-free. But there's a lot less to keep patched.
How does Atlas handle this?
Every site we build, including buildatlas.ai, is static HTML. The parts that run code, like contact forms and our phone answering, are small pieces of code we maintain ourselves, none of it PHP. When the PHP2Shell news broke, there was nothing for us or our clients to patch. If your site is on WordPress and you'd like to be off it, we'll rebuild it as static HTML for $499 one time, on hosting in your name. If you'd rather we keep running it, the switch is free on our $99 a month plan, which includes new content every two weeks to help you show up on Google and in AI assistants.
