A Laymans Guide to the Recent PHP Exploit

Now that there is more widespread knowledge around the recent and ongoing PHP exploit, it's worthwhile to bring it all together, and advise on what it could mean for you and your business.

The first point to note is that while this is a major security threat, (one of the IT specialist commenters on the BBC likened it to Def Con 1, the highest nuclear threat level) this is not a one off; it's the first sign of more AI-assisted exploits to come. Frankly when it comes to AI there are times when I feel like standing on a street corner and yelling, Hey everyone wake the f**k up and smell the coffee. It's that serious. Generally people have no idea what's coming down the pipe.

To provide better background, (putting moral arguments to the side) a hacker's business model is no different to that of yours or mine. They seek to build leads (a sales pipe) and then convert as many as possible into sales, via theft of data, ransomware etc. Typically this is done in two ways:

1. Building up a bank of "ghost" PCs they control (along with IP addresses) that can be used for denial-of-service attacks. Unless you are a state actor (like North Korea), you need to build up free physical resources to create a platform to work from.
2. Focusing on identified vulnerabilities in outdated software, exploiting them by creating back doors (often lying dormant) that can be activated later. This is their sales pipeline. Targets are sourced by running automated scripts across the internet 24/7.

There is now a third option: using AI to actively probe for potential exploits in software. AI can undoubtedly speed up vulnerability research. While capabilities vary, there is one particular LLM (a second-tier, well-known brand) that I'm not going to name here that is particularly good at doing this. An obvious first target is government software, as this sector can be slow to update and harden its systems. You simply task the LLM with finding exploits on a loop, and it keeps chipping away 24/7 until it finds something. This is the world we currently live in.

Against that background, let's come back to the current exploit. PHP is maintained by an open-source community and supported by the PHP Foundation. It's incredibly popular and is used by over 70% of global websites, primarily via WordPress but also other platforms such as Drupal. (Note all SiteSuite CMS clients run on PERL software and are not impacted) There was a known potential exploit, but no one could see how it could ever be accessed, until an AI model showed them how.

The timeline, as reported so far:

• Work on a security fix reportedly began in August 2026, in secret.
• Details of the work were reportedly leaked or sold;
• By mid-October, information about the issue was reportedly circulating. I assume this was determined via the dark web. It's either not known or disclosed at what point the information was leaked between August and mid October. We do not know precisely when attackers may first have gained access to the exploit.
• Emergency patches were released on 21 October 2026, prompting organisations to update rapidly. Some took sites or web pages offline as a precaution.

Which brings us to: What should I do?

1. Run a couple of quick DIY checks on your WordPress site

Look for unfamiliar user accounts, especially administrator accounts you don't recognise. Check for strange or unrelated pages, including pages outside your normal menu structure - for example, bogus product landing pages or suspicious advertising.

Please note: These checks are only warning signs when your site is compromised, a lack of their existence is certainly not proof that a site is clean. Hidden or dormant malware may leave no visible clues.

2. Contact your website hosting provider

Ask whether the relevant PHP security patches have been applied to the PHP version your website actually uses

Ask which PHP version your site runs on and whether it can safely be moved to a currently supported, patched release. PHP 8.4 is the earliest actively security updated version, please update to this version.

You will need to check plugin and theme compatibility before upgrading, if these preclude an update to PHP 8.4 upgrade or change them. Talk to us if you are unsure.

Ask how often backups are taken, how long they are retained and whether clean backups can be restored. Aim for at least daily backups. For our clients, we perform hourly backups.

3. Arrange a malware audit

A full malware audit obviously provides a much more thorough check than a quick visual inspection, this is the best way to achieve true peace of mind. When we audit client sites, we also carry out a general health check. Here is an example of a recent audit:

1. No malware detected.
2. No exploits or backdoors detected.
3. PHP core upgraded from 8.1 to 8.4.
4. Site theme updated.
5. Plugins updated.
6. LiteSpeed Cache plugin installed.
7. Redis implemented for site performance.

To get help and get started, please drop us a quick email at help@sitesuite.com.au. We'd be happy to talk through the options.

Kind regards,

Grant Goodger
CEO SiteSuite
E: grant@sitesuite.com.au
M: 0421 593 878

P.S. You can read more on the BBC and in the official PHP security advisory.