October 22, 2026
A critical security issue affecting PHP was announced this week.
You may have seen reports about a critical PHP security issue announced this week.
PHP is the software that sits behind a huge proportion of websites, including WordPress and Perch sites. The vulnerabilities are particularly significant because they were discovered using AI after remaining hidden in PHP for many years. The BBC quoted cyber-security firm Wiz describing them as the “most severe vulnerabilities ever discovered” by AI.
Our hosting providers were already aware of the issue and put additional protections in place while the permanent security fixes were being released.
The security updates have now been applied across the servers we use, including fixes for older PHP versions which are no longer officially supported. We have also reviewed the PHP versions used across the websites we manage and updated them where appropriate.
For clients whose websites are hosted and maintained by Greystoke Web Design, there’s nothing you need to do.
AI is also changing the WordPress security landscape. Wordfence reported in April that AI-assisted vulnerability research has increased rapidly, with around two-thirds of vulnerability reports in its bug bounty programme now involving some form of AI assistance. This means weaknesses in WordPress plugins and themes can be found much more quickly than before – which is good for security when they are responsibly reported and patched, but also makes keeping websites, plugins and hosting software up to date increasingly important.
We are definitely seeing more high-severity vulnerability alerts this year. Wordfence has also developed its own AI tools to try to find vulnerabilities before hackers do – including two critical vulnerabilities discovered in The Events Calendar plugin, which is used on more than 600,000 websites.
It’s something we expect to see much more of going forward.