The biggest cybersecurity problem facing website owners isn’t necessarily new code or increasingly sophisticated malware. It’s the security flaws that have been sitting in existing software for years, waiting to be discovered. October 2026’s PHP2Shell disclosure showed how quickly that can become a serious problem.
Two critical vulnerabilities in PHP, the programming language that powers WordPress and millions of other websites, allowed attackers to run malicious commands on vulnerable servers without logging in. The flaws were already there. What changed was how quickly attackers could find and exploit them, and AI is helping to close that gap. To put it into perspective: a decade-old vulnerability, exposed in days.
According to Wiz Research, frontier AI models helped identify the PHP2Shell vulnerabilities and combine them into working exploits. It reported that one researcher completed in a week what would previously have taken a specialist security team several months. That’s a massive shift in vulnerability research. AI didn’t introduce the programming errors; it just sped up finding them and developing working exploits.
The same technology is helping the defenders. Wiz used AI to verify patches, while OpenAI’s Codex Security identified a serious vulnerability in Node.js.
The quick wins are fairly simple: confirm PHP is patched, install available software updates, remove unused plug-ins, check backups and review potentially exposed credentials.
Domains.co.za
However, faster discovery doesn’t automatically mean faster protection. Developers still need to write and test fixes, hosting providers must deploy them, and website owners have to update the software they manage. Attackers can exploit the time between those steps, and PHP2Shell exposed exactly that patching problem.
Attempts to exploit PHP2Shell were recorded from 17 October 2026, before the flaws became public. Exploit details leaked on 20 October, emergency updates followed on 21 October, and the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation on 26 October. That left a particularly uncomfortable reality: attacks were already happening while organisations were still working to protect their systems.
PHP wasn’t the only one, either. A vulnerability in the Backuply WordPress plug-in affected more than 600 000 installations, and a compromised LiteLLM release distributed info-stealing malware through trusted software channels. These incidents involved different weaknesses, but they share a pattern: businesses are increasingly dependent on software they don’t develop, maintain or fully control.
For smaller businesses, the challenge is knowing where their hosting provider’s responsibilities end and theirs begin. On shared hosting, providers generally manage server-level PHP patches, operating-system security and firewall rules. But a patched server doesn’t automatically fix an outdated plug-in. Website owners still need to manage WordPress core, plug-ins, themes, user accounts and credentials. Users of self-managed virtual private servers (VPSs) also need to account for their own server software and developer packages.
You can’t control when new vulnerabilities are exploited, but you can control how long your website remains exposed to a known one.
Domains.co.za
The quick wins are fairly simple: confirm PHP is patched, install available software updates, remove unused plug-ins, check backups and review potentially exposed credentials.
No hosting environment can offer complete invulnerability to attacks. Instead, it comes down to how quickly known risks are handled once fixes become available. Domains.co.za Web Hosting provides server-level protection, including a web application firewall, malware protection, account isolation and daily off-site backups. These help address the hosting side of the equation, but website owners still need to keep their software updated and locked down.
The takeaway is simple: you can’t control when new vulnerabilities are exploited, but you can control how long your website remains exposed to a known one. Start by checking your PHP version in cPanel, and explore Domains.co.za Web Hosting to see how we take care of our server security.
About Domains.co.za
Domains.co.za is a pioneer in the domain name and web hosting industry in South Africa. As a registrar accredited by the Internet Corporation for Assigned Names and Numbers (Icann), the company offers the best in web hosting solutions, including incredibly fast, secure and reliable cPanel Web Hosting, WordPress Hosting, Managed cPanel VM Hosting and Self-hosted n8n VPS Hosting. Try the AI Domain Name Generator and value-added services including SSLs, Domain Protection, Site Builder and Link in Bio. With a focus on innovation and customer satisfaction, Domains.co.za continues to deliver industry firsts to the benefit of local start-ups, entrepreneurs, small and medium-sized enterprises (SMEs) and companies. Follow Domains.co.za on Facebook, Instagram, LinkedIn, X, YouTube and TikTok.
- Read more articles by Domains.co.za on TechCentral
- This promoted content was paid for by the party concerned
