.png)
AI and the Website Security Scare: Explained in Plain English
You may have seen some pretty scary headlines this week about AI discovering a security flaw that could put millions of websites at risk.
One headline from The Wall Street Journal even mentioned 70% of the world's websites. That's a big number. And if you're a business owner with a website, it's understandable to wonder whether yours is safe.
So, what's really going on, and should you be concerned? We'll skip the complicated tech talk and explain what you need to know.
What Happened?
On October 21, 2026, news broke about two major security problems involving something called PHP.
Never heard of PHP? No worries.
PHP is a type of computer code that helps websites work. You don't see it when you visit a website, but it's running in the background, doing things like processing forms and pulling up information.
Researchers used artificial intelligence (AI) to help discover two serious weaknesses in that PHP code.
Think of it like finding a faulty lock on a door. The door might have been working just fine for years, but someone eventually realizes there's a way to open it without a key.
That's essentially what researchers found. These weaknesses could give hackers a way into certain website servers without permission.
The discovery made headlines because PHP is used by so many websites, including many built with WordPress.
You can read more about the discovery in The Wall Street Journal's original article.
So, Does This Mean 70% of the World's Websites Have Been Hacked?
No, and this is probably the most important thing to understand.
That 70% number refers to how widely PHP is used, not how many websites have been hacked.
Here's another way to think about it.
Imagine a car manufacturer discovers a problem with a part used in millions of cars. That doesn't mean every car has broken down. It means the affected cars need to be checked and, if necessary, repaired.
It's the same idea here.
Some websites may be running versions of PHP with these security problems. Others may already have the fixes installed, or may not use the affected software at all.
The headline is serious, but it doesn't mean nearly every website on the internet has been broken into.
Is Someone Fixing This?
Yes!
The people who maintain PHP have already released updates to fix the problems.
The catch is that those updates still need to be installed wherever the affected software is being used.
For some websites, the hosting company handles that work. For others, it's something a website developer or IT team needs to take care of.
The National Security Agency (NSA) has also recommended that affected systems be updated as soon as possible.
So, while this is a real security concern, there are fixes available.
What Should I Do About My Website?
You probably don't need to do anything complicated yourself.
The best place to start is by finding out who's responsible for the technical side of your website.
If you work with a website developer, marketing agency, or IT company, you can simply ask:
"I saw the news about the PHP security issue. Is this something that affects my website, and are we up to date?"
That's it. You don't need to know how to update PHP or even whether your website uses it.
If you manage your own website, check with your hosting provider to see whether any updates are needed.
And if your website uses WordPress, it's especially worth checking that your server's PHP software has been updated. Updating WordPress itself or its plugins isn't necessarily enough to fix this particular problem.
What Does AI Have to Do With All This?
This is one of the most interesting parts of the story.
AI helped security researchers find weaknesses in computer code that had been overlooked for years. In other words, AI wasn't necessarily the hacker in this story. It was a tool that helped people find a problem so it could be fixed.
Of course, hackers can use AI tools too. That's part of why this discovery is getting so much attention. As AI gets better at finding problems in software, both security experts and hackers may be able to discover weaknesses much faster than before.
Should I Be Worried?
There's no reason to panic, but this is a good reminder that keeping your website secure is an ongoing process.
Just like your phone or computer, websites need updates from time to time to fix problems and keep things running safely. Some of those updates happen automatically, while others need to be handled by your website provider or whoever manages your site.
The important thing is knowing who's taking care of those updates. If you're not sure, now's a good time to ask. A quick check-in can give you some peace of mind.
A Note to Our Cartography Clients
If Cartography built your website, there's no indication that your site has been affected by this security issue, and there's nothing you need to do on your end at this time.
We're keeping an eye on updates from our website provider and will let you know if anything changes or requires your attention.
Want to Read More?
We've kept things simple here, but if you'd like to dig into the details, these are some helpful resources:
