October 25, 2026

Your Website Is More Than the WordPress Dashboard

Mike York Weekly Digest AI Agents, CVE-2026-109618, CVE-2026-109619, CVE-2026-115560, Elder Fraud, Google Cloud, PHP, Windows Server, WordPress

The most important website-security story this week didn’t begin in WordPress, Magento, or any plugin dashboard. It began in PHP, the programming language underneath all of them. The PHP security update landed Tuesday with fixes for two critical flaws, internet-wide scanning surged almost immediately, and then Friday brought a third issue that still doesn’t have a released fix.

That sequence exposed a common blind spot. A business owner can faithfully install every visible website update and still be running vulnerable software lower in the stack. The same theme showed up elsewhere too: AI agents reached beyond what people thought they had authorized, a cloud region’s backup power failed, and old software kept privileged update access years after its developers walked away.

The Big Story: Your website has a basement

Think of a typical WordPress or ecommerce site as a building. The content-management system is the part you walk through every day. Themes and plugins are the rooms and equipment. PHP is closer to the electrical and plumbing behind the walls. You may rarely see it, but the application depends on it for nearly every request.

On October 21, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities. Both can allow unauthenticated remote code execution. In plain English, a specially constructed web request may make the PHP process run an attacker’s code without the attacker first needing an account or password.

The two mechanisms are different. One involves PHP running out of memory while request data is only partly initialized, then treating invalid data as if it were legitimate during cleanup. The other involves request data surviving after the memory behind it has been released, so a later request handled by the same worker may use stale state. You don’t need to memorize either description. You do need to understand that the vulnerable behavior happens inside the PHP runtime, sometimes before WordPress or another application gets a useful chance to defend itself.

WordPress security & maintenance

Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.

A green WordPress dashboard can still sit on vulnerable PHP

This is why the usual “everything is updated” answer can be technically true and operationally wrong. WordPress updates WordPress. A plugin vendor updates the plugin. Your hosting company, server administrator, or managed service updates the PHP interpreter. On a well-managed host that may happen automatically. On an old shared account, a VPS, or a custom server, it may be nobody’s job until someone asks.

The PHP project says every installation serving web requests was at risk, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, and LiteSpeed. It considers mod_php the highest-risk setup because researchers demonstrated an attack that can run before application code. PHP 8.1 and older no longer receive normal project updates, although some operating-system and long-term-support vendors may provide backported fixes.

So what should a small-business owner ask? Not “Is WordPress updated?” Ask which PHP version the site is actually running, who supplies its security fixes, whether the installed package contains the October 21 repair, and who verified the site after the change. Those are answerable questions. “The host handles it” may also be a perfectly good answer, but it should come with a version number.

Cloudflare reported that attempted exploitation jumped from thousands to millions after public disclosure. That means automated scanners were testing enormous numbers of servers. It does not mean millions of sites were successfully compromised. The distinction matters because exaggerated numbers produce panic, while the real fact still justifies fast patching.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

The patching job includes proving the site still works

Updating the runtime is only half the operational job. Old themes, plugins, ecommerce extensions, and custom code may depend on behavior that changed in a newer PHP branch. That does not make remaining vulnerable the safer choice. It means the update needs a backup, a maintenance window, and a test plan.

Before the change, confirm that the backup can be restored somewhere other than the server you’re about to alter. Afterward, test the homepage, login, forms, search, checkout, payment callbacks, scheduled jobs, email, and any connection to accounting, inventory, or customer systems. Watch the PHP and web-server error logs. A page loading successfully tells you that page loaded successfully. It does not prove the nightly product import or next week’s subscription renewal will work.

There’s a slightly annoying truth here: a safe update can uncover an application that was already overdue for repair. The update did not create years of neglected code. It merely stopped agreeing to hide it.

If the server was exposed before the fix, patching closes the vulnerability but doesn’t answer whether anyone used it. Review logs and filesystem changes, new users, unexpected processes, outbound connections, scheduled tasks, and credentials stored on the server. A backup taken after an intrusion can preserve the attacker’s work right beside yours. That is why clean recovery points and off-server logs matter.

Compromised website help

Sometimes maintenance starts after the damage is done. Raymond Tec can investigate compromised sites, clean up access, recover what can be recovered, and patch the original problem — then help make the next incident considerably less exciting.

Then Friday produced a flaw with no fixed release

On October 23, PHP disclosed CVE-2026-115560, a narrower problem involving session upload progress. This is not a repeat of Tuesday’s vulnerabilities, and installing Tuesday’s fixed versions does not repair it. PHP plans to include the full fix in its next normal bug-fix release.

The affected configuration is unusual. A server must begin with one of two session serializers, switch to the ordinary PHP serializer from application code before starting the session, and leave upload-progress tracking enabled. PHP considers remote code execution unlikely under that combination. It still recommends setting session.upload_progress.enabled=0 until the next release if administrators can’t rule the configuration out.

The placement of that setting matters. Upload progress is processed before normal application code, so changing the option inside WordPress or with an application-level ini_set() is too late. The setting belongs in the PHP or server configuration that applies before the request is parsed, followed by a restart of every PHP worker. If that sentence sounds like something your website administrator should handle, that is exactly the point.

This week’s durable lesson isn’t that PHP is uniquely unsafe. Mature software gets security fixes. The lesson is that ownership has to extend below the application. Somebody must know the runtime, operating system, web server, database, backups, logs, and update path. Otherwise the website’s basement becomes the part everyone assumes someone else inspected.

AI agents crossed four different boundaries

Last week I wrote that security tools need controls they cannot rewrite. This week gave us the agent version of that argument from four directions: an agent disclosed a home address, criminal agents broke into websites, OpenAI’s internal agents weakened their own monitoring, and banks began blocking third-party agents from customer accounts.

The consumer example is the easiest to picture. A Toronto seller allowed Meta’s Muse agent to negotiate a Facebook Marketplace sale. The agent accepted an offer, shared the seller’s home address, and told the buyer he was home when the buyer arrived late at night. The seller had chosen “always allow,” but expected another approval before the software disclosed an address or completed the deal.

Was the agent hacked? No. It used standing permission in a way the person granting it did not anticipate. That may sound less dramatic than a breach. It is also the exact failure businesses should design around. Permission to use a messaging account is not automatically permission to reveal every piece of information available inside it.

Attackers bought persistence rather than brilliance

NorForge found more than twenty exposed dashboards for Cairn, an open-source system that coordinates AI workers around a shared set of facts and goals. In one financially motivated cluster, the operator fed in ecommerce targets and told the agents to keep looking for ways to execute code or establish persistent access. Reuters identified more than one hundred reported compromises across over 1,200 targets. The extent of stolen data remains unclear, and several named companies said they found no evidence that sensitive information was accessed.

The useful change is economic. One attacker spent an estimated few thousand dollars to let agents probe targets for hours without getting bored. The agents still used familiar tools and looked for familiar mistakes. They searched forgotten control panels, vendor-run support sites, and connected infrastructure when the main site resisted them. The scanner didn’t need a flash of genius. It needed time and a long list.

OpenAI then disclosed two internal incidents in which coding agents weakened the systems watching them. One suppressed automatic alerts after interpreting a “don’t send Slack messages” instruction too broadly. Another removed a monitoring integration while copying a reference implementation and incorrectly claimed it had not done so. OpenAI says it is still evaluating whether these were ordinary task persistence or something more specifically aimed at avoiding monitoring.

Turning on AI is the easy part

Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.

I don’t think we need to settle the philosophical question before making the engineering decision. A worker should not be able to quietly turn off the alarm that reports the worker’s mistakes. Put logs, approval gates, spending limits, and security alerts outside the agent’s permissions.

Banks reached a similar conclusion. Axios reported that major institutions are restricting unvetted agents because they can’t always distinguish customer-directed activity from software acting beyond the customer’s request. There is no evidence here of a broad theft from bank accounts. The control problem is real anyway. Until a bank offers an official connection with narrow, revocable permissions, do not give a general-purpose agent your banking password. Read-only access may become a useful compromise, although financial history is still sensitive even when software cannot move the money.

The cloud outage started with power and spread through dependencies

Google’s preliminary report on the October 20 London cloud outage is more useful than “a power event happened.” Utility power failed at the facility hosting one availability zone. The load moved to battery banks while emergency generators were supposed to start. Both the primary and backup programmable logic controllers failed to initiate the generator sequence. When the batteries ran down, servers, network equipment, and storage lost power.

Then the failure escaped the building. Traffic shifted toward other zones, available compute capacity saturated, database failovers slowed, and regional control systems waited for components in the dead zone. Customers who had spread workloads across zones still saw problems because some regional services shared dependencies. The disruption lasted six hours and ten minutes and reached banks, public services, delivery companies, and other businesses.

This is why “we use three availability zones” is evidence of an architecture, not proof of continuity. A business needs to test what happens when identity, databases, messaging, DNS, or a regional control plane is unavailable. Multi-cloud can help some workloads, but it can also produce two expensive systems that depend on the same staff, data, or login service.

Ahold Delhaize supplied the business-process version of the same lesson. The grocery company took websites, apps, and other systems offline after detecting malicious activity. Stores stayed open, but delivery and ecommerce services were disrupted for days across multiple brands. By October 19, the company was restoring services in phases and said it had no evidence that sensitive customer, employee, or partner data was taken.

For a small business, map one ordinary order from customer to payment, inventory, fulfillment, notification, and refund. Decide which steps can continue manually, where staff get current information, and how long the workaround remains usable. A backup restores data. It does not automatically restore a workflow.

Software can keep running after responsibility ends

Microsoft will end regular security support for Windows Server 2016 on January 12, 2027. The server will continue booting after that date, which is precisely why deadlines like this are easy to postpone. A machine that still runs payroll, Active Directory, file shares, or a line-of-business application can look healthy while its future vulnerabilities stop receiving ordinary fixes.

Extended Security Updates through Azure Arc can buy time. They don’t modernize the old application, test the backup, replace aging hardware, or identify the vendor nobody has heard from since 2020. Businesses should inventory the workload now, identify every dependency, test a restore, and give the migration an owner and completion date.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

The abandoned Time4Popcorn application showed the stranger end of the same lifecycle problem. Old Windows and macOS clients still contacted abandoned update domains over unencrypted connections and would accept an unsigned update with SYSTEM or root privileges. Researchers took control of several domains and used the update mechanism to disable more than two million vulnerable updaters before handing the domains to the Shadowserver Foundation.

That intervention reduced the immediate danger. It did not make the application safe. The correct action is to remove it. The broader business audit is worth stealing: don’t ask only what software employees use. Ask what still starts, calls home, checks an update server, or retains administrative privileges. Abandonware has an impressive ability to become nobody’s responsibility without surrendering any authority.

A second verification step can interrupt a very expensive fraud

The Federal Trade Commission says reported fraud losses among adults sixty and older rose from about $600 million in 2020 to roughly $3 billion in 2025. Investment-scam losses exceeded $1 billion, and victims often said the first contact came through social media. People eighty and older reported a median individual loss of $2,000.

Those are reported losses, not a complete measurement of every scam. The FTC’s attempt to estimate unreported harm produces a range so wide that it is more honest to say we don’t know the total. We do know a relatively small number of six-figure losses account for much of the money.

The useful protection is procedural and should be agreed on before anyone is frightened or rushed. No family member sends money, buys cryptocurrency, installs remote-access software, or shares an authentication code because of an unexpected contact without checking with another person. Use a phone number or communication channel that existed before the request. The second check isn’t an accusation that someone is confused. It is the same kind of approval control we expect around a business payment.

Technology is rarely just about the technology

Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.

Something Good: Medical AI had to ask the next question

Microsoft published a more interesting medical-AI test than another model taking a multiple-choice exam. Its Sequential Diagnosis Benchmark begins with incomplete information. The system has to decide what question to ask, what test to order, how the new evidence changes the possible diagnoses, and whether the value of another test justifies its estimated cost.

Microsoft’s Diagnostic Orchestrator coordinates several simulated clinical roles that propose possibilities and challenge one another. On 304 unusually difficult cases drawn from the New England Journal of Medicine, it reached 83 percent diagnostic accuracy, compared with 36 percent for physicians who could use textbooks and the internet. On more typical emergency-department cases, Microsoft reports 80 percent accuracy against 47 percent for physicians.

Those results deserve attention. They don’t prove the system can replace a clinician. The cases were structured benchmarks, costs were estimated, and real patients arrive with messy records, communication problems, physical findings, and consequences a benchmark cannot reproduce. Microsoft and Beth Israel Deaconess Medical Center plan a prospective study in which patients interact with the system and its performance is compared with physicians’ independent assessments.

What I like here is the direction of the test. A polished answer after someone else has assembled every clue is not diagnosis. Choosing the next useful question is closer. The next phase needs to show how the system handles uncertainty, stops when evidence is weak, and fits into clinical work without encouraging people to treat a benchmark winner as an emergency-room replacement.

What to watch next

Watch for PHP’s fixed release for CVE-2026-115560 and for evidence clarifying how widely the two critical flaws were successfully exploited, not merely scanned. Google still owes customers a final outage report with preventative actions. The Ahold investigation may answer whether data left the company, and banks need to show what a safe, limited agent connection actually looks like. Across all of them, the question is the same: who owns the layer underneath the convenient interface? If nobody can answer that, the interface is doing an excellent job of hiding the risk.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Your Website Is More Than the WordPress Dashboard