Yes, and it already does. In October 2026, a security researcher found that one hacker’s AI agents had tried to break into more than 1,200 websites and got into sites belonging to more than 100 companies. The researcher put the AI bill at about US$5,000, around US$50 a break-in (Reuters). The same month, PHP, the software underneath WordPress and much of the web, fixed two serious holes in code about 14 years old. AI tools had helped find them.
Is your site one of the easy ones? It might be, if it runs software nobody keeps updated: a stack of plugins is the usual way in. What keeps the risk down hasn’t changed: keep the software up to date, and run as little of it as the site needs.
AI agents already break into websites on their own
The October case wasn’t a research project. A cybersecurity firm, NorForge, found that someone had handed the work to AI agents: software that probes a website for weaknesses and tries to get in, for hours, without a person steering. Some of the sites they got into belonged to large companies (Reuters).
Researchers had shown this was coming. In 2024, an AI agent given the published description of a security flaw managed to exploit 87% of a set of 15 real ones; without the description, 7% (Fang and others, 2024). Holes get published so that people can fix them, and AI turns that notice into the attack. The most-attacked WordPress holes found in 2025 were typically being used against websites within five hours of going public (Patchstack).
A 14-year-old hole, found with AI
On 21 October 2026, PHP put out an urgent fix for two flaws that let someone who isn’t logged in run their own code on a website’s server (PHP’s announcement). Governments overseas took websites offline as a precaution, RNZ reported, and New Zealand’s National Cyber Security Centre said it was aware of reports of attacks. Two security firms had found the problem separately in August, less than three weeks apart, both using AI tools, and OpenAI itself said the same abilities help attackers build exploits quickly (Fortune).
If your site is on WordPress, updating WordPress won’t fix this one. The hole is in PHP, and only your host can update that. Send them this:
Has PHP on my site been updated for CVE-2026-109618 and CVE-2026-109619?
If they say your site is on a version older than 8.3, ask what it would take to move it to 8.3 or newer. PHP no longer puts out updates for anything older than 8.2, and 8.2 stops getting them on 31 December 2026.
Not sure what you’re on? If you log in to make changes at an address ending in /wp-admin, it’s WordPress. Your host’s name will be on your hosting invoice. If your site is on Wix, Squarespace or Shopify, there’s nothing for you to do: those companies run their own servers.
The less your site runs, the less there is to break into
Every plugin, theme, database and login page is software someone wrote, and any of it can have a hole nobody has found yet. As AI gets better at finding them, each extra piece is one more thing to search.
That leaves two ways to run a website:
- Keep up. Update everything, promptly, for as long as the site is up. It works, but plenty of sites don’t manage it: on WordPress’s own figures, more than a third of WordPress sites were running a version of PHP with no security fixes in October 2026 (WordPress.org).
- Have less there. A site with no plugins, no database and no login page gives an attacker, and their AI, very little to work with.
Nothing online is ever impossible to break, but a site with less on it is a much smaller target.
What a smaller target looks like
We build every site this way. The pages are built ahead of time and served from Cloudflare, which also runs the forms. A site built like that has no PHP, WordPress, plugins, database or login page, so this one can’t reach it.
You shouldn’t need to know what PHP is to run a business. On our plans you don’t need to: if anything on your site breaks, we fix it within two working days, and Craig is the one person you ring. The website goes back to being the thing you don’t think about.
When WordPress is still the right call
This flaw isn’t WordPress’s fault: it’s in PHP, and a well-run host will have patched it already. WordPress earns its keep where you post or change things often, as long as someone keeps it, its plugins and PHP up to date. How it compares with the other builders is in What is the most secure website builder?
What to do this week
- On WordPress, or anything else that runs on PHP: ask your host whether PHP has been updated for the two flaws from October 2026, and whether you’re on 8.3 or newer.
- Turn on two-step login for your domain, your hosting and your email, whatever your site is built on, so signing in also needs a code sent to your phone.
- Work out who you’d ring if your site went down or got hacked tonight. If the answer is “no idea”, that’s the thing to fix.
Find out how quick your site is
What a phone has to download to open your site is where the plugins and widgets show up, and the free report measures that. We run Google’s speed test and email you the score out of 100, with a plain-English note on what’s slowing it down, usually within five minutes. It isn’t a security check, so it won’t tell you whether your site has been patched; your host is the one to ask. If it comes back fine, we’ll say so.