AI found PHP flaws — what does it mean for your website?

AI is uncovering longstanding vulnerabilities and changing website development. See how FEIM connects modern websites, AI-assisted development and supporting business systems.

Concept illustration: a black computing core connects to system modules while a beam reveals a red fissure in one module

In October 2026, critical flaws in PHP’s core were disclosed after remaining in the code for more than a decade. Wiz researchers found them with help from AI.

This changes how businesses should think about the foundations of their websites: the software they depend on, who maintains it and how quickly it can be updated.

What did AI help uncover in PHP?

Wiz researchers used AI models to identify memory-safety flaws in PHP itself. Exploitation could enable unauthenticated code execution or disclosure of sensitive server memory, regardless of the application running on top. Wiz’s research.

PHP powers systems including WordPress, Drupal and Joomla. PHP released fixes on 21 October 2026. Ask your maintainer to confirm that your server is patched. See PHP’s official advisory and our practical guide to the PHP update.

AI accelerates both defence and attacks

According to Wiz, demonstrating exploitation required chaining flaws and adapting to different environments. AI substantially accelerated that work: the researchers describe one person completing in a week what previously would have required a highly skilled team months.

The same capabilities can help defenders and attackers. For a business, a practical question follows: how quickly can your website’s software be assessed, updated and tested?

Security also depends on maintenance responsibilities

Website security depends on the software involved and the people responsible for it. A typical WordPress setup includes server software, PHP, WordPress, a theme and plugins. Responsibilities can be divided between a host, a developer and the business.

When a fix is urgent, compatibility and clear ownership matter. Confirming responsibility before an incident helps avoid delays when an update is needed.

What does an AI-native website mean at FEIM?

At FEIM, AI is part of development from the start. In practice, this combines four elements:

Custom code without the WordPress plugin chain. New websites use Next.js and do not require PHP or the WordPress plugin system.
AI-assisted development. AI supports planning and implementation; the developer reviews the result before use.
Readable content and structure. Clear answers and appropriate structured data help search systems understand a website, without guaranteeing AI search visibility.
Room to grow. Enquiry journeys, calculators and integrations can be built into the site. Where useful, it can connect to an application or an MCP server with scoped access for AI agents.

Four benefits for your business

PHP and WordPress dependencies are removed. These PHP vulnerabilities do not directly target a site that does not use PHP. Vercel maintains its own platform infrastructure; FEIM handles agreed application maintenance.
Foundations for AI search visibility. Customers can discover services through AI search as well as traditional search. Clear, accessible content is a starting point, not a guarantee of inclusion. Read our guide to GEO.
Further development around your needs. Connected AI features can benefit from model improvements after evaluation and testing. Custom development can follow your business priorities. Read Be where development happens.
Clear responsibility. Agreeing who maintains the website, reviews changes and handles problems gives your business a concrete point of contact.

Modern websites still need maintenance

Custom code is not immune to vulnerabilities. Libraries and external services need updates, and security also depends on access permissions, data handling and testing. AI supports development; the developer remains responsible for quality.

A well-maintained WordPress site can still serve a business. FEIM’s approach removes the PHP and WordPress maintenance chain while retaining responsibility for the other software and services used.

Frequently asked questions

Why are years-old security flaws being found now?

AI helps researchers analyse complex code and investigate combinations of bugs faster. A long history of use alone does not establish that software is secure.

Does an AI-native website mean adding a chatbot?

At FEIM, AI supports planning, software development and problem-solving. Visible AI features can also be built when they help customers or simplify your business’s work.

Can FEIM build systems to support my website?

Yes. FEIM can develop a customer portal, quoting system, booking management or a sales tool. The website and supporting system are designed to work together.

How can a website enquiry become part of sales?

An enquiry can flow into a sales system, collect the information needed and connect to follow-up actions. This reduces manual data transfer and makes enquiry handling clearer.

How does FEIM use AI in more demanding projects?

FEIM combines AI-assisted development, custom code, databases and APIs. Where useful, AI agents or an MCP connection can access agreed system functions within defined permissions.

Can the system be built in stages?

Yes. Start with the website and its most important customer journey. Add systems, integrations and automation when there is a clear need. Each stage’s scope is agreed separately.

Can the system develop as AI models improve?

AI-connected features can be developed using new models. FEIM assesses suitability and tests changes before putting them into use.

What does your business need from its website next?

Arrange the urgent PHP update with your current maintainer first. Then consider the wider role of your website: do enquiries reach you, can customers find your services, and can the site develop with your business?

Tell FEIM your website address and what you would like it to do better. We can explore an AI-native website and supporting systems around your sales and operations.

Explore FEIM’s website services or get in touch.

Information checked on 21 October 2026. Refer to PHP’s official advisory for subsequent updates.