Hey everyone, Kavan here. Quick heads-up for anyone who builds or looks after websites for clients. On Wednesday, PHP shipped an emergency release for two critical bugs, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker can take over an unpatched server without logging in. The site’s own code doesn’t need to be flawed, and WordPress is affected. Details leaked a day before the patch, and security firms are already reporting early attack attempts. Quick checklist: 1. List every client site you manage that runs PHP (WordPress, WooCommerce, Laravel and so on). 2. Check with each host whether they’ve patched or mitigated. Some, like SiteGround, protected their servers before the fix even landed. 3. If you manage the server yourself, update to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and restart PHP. Anything on 8.1 or older is out of support, so it needs upgrading, not just patching. My take on the AI side, as a builder, not a security expert: the researchers used AI to help find these bugs and test the exploit across different setups. This time, AI helped "the good guys" get there first. But the same tools are open to anyone, which is what makes it double-edged: the time between a bug going public and someone trying to use it is likely to keep shrinking. For anyone running client sites, “who patches this, and how fast?” is becoming part of the job. Curious where you all land: does AI end up favouring attackers or defenders? And how are you handling patching across client sites? 👇