A.I. Discovered a Critical Security Flaw Underpinning Websites
https://www.nytimes.com/2026/10/21/us/politics/php-vulnerability-ai-openai-cybersecurity.html?unlocked_article_code=1.KlE.Xoyp.lhlNUJ9rk0Er&smid=url-share
That “underpinning” is PHP, the software that runs WordPress. I updated to PHP 8.5, the latest version, and now it’s up to Bluehost to apply the patches.
Update(Oct 21st 13:00est): As a reminder, keeping your environment up to date is one of the best ways to protect your site. These guides cover recommended practices for maintaining a secure, well-performing setup:
WordPress Best Practices for Performance and Security
Bluehost Best Practices for VPS and Dedicated Server
Update(Oct 21st 12:18est): Our teams have made significant progress applying the latest PHP security patches across our servers. The majority of servers are now updated, and we’re continuing to roll out the remaining patches as quickly as possible.
As you may be aware PHP has reported an issue. To protect our customers, we are proactively taking steps to protect our customer base with various mitigations related to the PHP CVE. You should see no impact to the operation of your website or email but may see limits on the file size you can upload. Once patches have been confirmed released we will apply them as soon as possible.
Follow-up: Looks like the version of PHP I installed, 8.5.12, already had the fix.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
https://www.php.net/index.php#2026-10-21-5
