By Bob Paradise, Founder and Owner, Attain Technology

Is yours one of them? Here is how to find out in five minutes.

This week, artificial intelligence found a serious security hole in the software behind roughly 70% of the world’s websites. A fix came out on October 21. Now every website owner needs to make sure the fix is actually installed.

Think of it like a recall on your car. The manufacturer found a faulty lock. The repair is ready. But it only works if somebody puts it on your car.

Why this matters to your business

Security agencies warned that hackers could break into websites and read information that could include passwords. That means a hacker could take over your site, steal customer information, or knock you offline. For a small business, that is a data breach waiting to happen.

Governments and companies around the world raced to fix it. Some websites even went offline briefly while teams scrambled.

And plenty of sites are still exposed. Shortly after the fix came out, a scanning company found about 1.5 million of the 2.6 million servers it monitors had not been updated yet.

Does this affect my website?

Probably. If your site runs on WordPress or was built by a web designer, assume it does. If you are not sure, assume it does.

What to do today

You do not have to fix this yourself. You just need to send one email or make one call to whoever built or hosts your website.

Say this:

“There is a major security update out this week affecting most websites. Has it been applied to our site? Please confirm in writing.”

That is it. A good web designer or web host will know exactly what you mean.

Do not accept “we will get to it.” Ask for a date, and ask them to tell you when it is done.

What if my site is old?

Older websites sometimes cannot take the fix without a bigger upgrade. If your web company says that, do not panic, and do not wait. Ask what it will take and put it on the calendar.

What if I do not know who runs my website?

Find out today. Check your hosting bill. Or look up who registered your domain name. Not knowing who is responsible for your website security is a risk all by itself.

The bottom line

A five-minute email today beats a five-week cleanup later.

Attain Technology provides managed IT services and cybersecurity for small and mid-sized businesses across Rhode Island and Eastern Massachusetts. Not sure who should be handling your website security? Call us at 401-244-5200. We will point you in the right direction.

Read more about the vulnerability

• CNN: Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet. https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl
• The Washington Post: Websites scramble to fix software flaw that could put much of internet at risk. https://www.washingtonpost.com/technology/2026/10/21/websites-scramble-fix-software-flaw-that-could-put-much-internet-risk/

 

FAQ

What is the website security flaw everyone is talking about?

Artificial intelligence helped researchers find two serious security flaws in PHP, the software behind roughly 70% of the world’s websites. The PHP Foundation released an emergency fix on October 21, 2026. Website owners need to make sure that fix is installed.

Does this affect my business website?

Probably. If your site runs on WordPress or was built by a web designer, assume it is affected until your web company tells you otherwise.

What should I ask my web designer or web host?

Ask this: “There is a major security update out this week affecting most websites. Has it been applied to our site? Please confirm in writing.” A good web company will know exactly what you mean. Ask for a date if the update is not done yet.

What could happen if my website is not patched?

Security agencies warned that hackers could break into websites and read information that could include passwords. That could mean a site takeover, stolen customer information, or your website going offline.

How do I find out who manages my website?

Check your hosting invoice, or look up who registered your domain name. Your hosting company or the company that built your site is usually the one responsible for updates.

What if my website is old and cannot be updated?

Older websites sometimes cannot take the fix without a bigger upgrade. Ask your web company what it will take, and put it on the calendar right away.

Can Attain Technology help with website and IT security?

Yes. Attain Technology provides managed IT services and cybersecurity for small and mid-sized businesses across Rhode Island and Eastern Massachusetts. Call 401-244-5200 and we will point you in the right direction.