PHP2Shell: Websites Went Dark Worldwide. Is Your Website Safe? (Do This Now)

This week, websites around the world went dark. Government sites in Europe were taken offline. The reason? AI helped researchers find two critical flaws in PHP, the language behind about seventy percent of all websites, including WordPress. If you have a website, here is what happened, and exactly what to do in the next ten minutes.

Hey, I'm Adam, and welcome to Build and Earn AI. Step number two is the one most people get wrong. So what happened? The flaws are called PHP2Shell. Two bugs, both rated nine point two out of ten. In the worst case, an attacker could run their own code on a server, without any password.

Researchers from OpenAI, Wiz, and Calif found them with the help of AI. The scary part: Wiz said the bugs had been hiding in PHP for about ten years. The NSA and Europe's cybersecurity agency told companies to act right away, and some sites in the Netherlands and Ireland went offline while they fixed it.

On October twenty first, PHP released fixed versions: eight point five point twelve, eight point four point twenty seven, eight point three point thirty six, and eight point two point thirty five. And security researchers reported attacks starting the same day. Here's the important part. Updating WordPress does not fix this. The bug is in PHP, on the server.

So let's go through five steps. Step one: check your PHP version. In WordPress, go to Tools, Site Health, Info, then Server, and look at PHP version. If you're on eight point one or older, that branch gets no new fix from PHP, so you need to move up. Step two: ask your host, and get a clear yes.

On shared hosting, updating PHP is your host's job, not yours. Check their status page or ask support: is the fix for both PHP2Shell bugs installed? A firewall rule alone is not the same as a patched PHP. For example, Hostinger posted that their platform was tested and not vulnerable, that they added extra protection, and that they're rolling out the patched PHP versions, with no action needed from customers.

Quick question. Did your host tell you anything about this? Yes, one, or nothing at all, two? Comment one or two. Step three: if you're on an old PHP, back up and upgrade. Take a full backup first. Then switch the site to PHP eight point three or eight point four from your hosting panel, and test your main pages, forms, and checkout.

Old plugins sometimes break, so test before you celebrate. Step four: look for signs of a hack. Check for admin users you don't recognize, plugins you never installed, PHP files inside the uploads folder, spam pages when you search site colon your domain on Google, and any warnings in Google Search Console or from your host.

Step five: backups, passwords, and a safety net. Keep automatic backups you can restore in minutes. If anything looks wrong, restore a clean backup and change every password: WordPress, hosting, and database. And a free Cloudflare plan can block known attacks, if your traffic goes through it. And here's the money angle. Most small businesses have no idea this even happened.

If you build websites, this is the perfect reason to message your clients and offer a security check, plus a monthly care plan for updates and backups. That's real recurring income. The lesson: choose hosting that patches fast and gives you easy backups. My hosting link and the coupon code LEARN2EARN are in the description.

Subscribe for more real ways to build and earn with AI, and tell me in the comments: did your host tell you anything, yes, one, or nothing, two? I'll see you in the next one.