Article
In a single week, AI found serious holes in the software that runs most of the web, and Google unveiled its most powerful model with finding more of them as a headline skill. If you run a website, both stories are about you.
The bug that shook the web
On October 21, the PHP project released emergency patches for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Under the right conditions, they let an attacker run code on a server without logging in. PHP underpins roughly 70% of websites, including the WordPress and Drupal sites many small businesses run on. Wiz, which found the flaws independently, said every PHP version released in the past decade is affected by at least one of them. CISA urged organizations to patch, prioritizing systems facing the internet, and some sites went offline while their teams updated.
What made this one different is who found it. The bugs surfaced during an audit of PHP's source code funded through OpenAI's Patch the Planet initiative, and PHP's advisory credits researchers from Calif, Wiz and OpenAI. Google also says its Gemini models helped with discovery and with verifying the fixes.
Google's move: defenders first
One week later, on October 28, Google announced Gemini 4 Carbon, which it describes as its strongest model, with leading cybersecurity and long-running task abilities. Instead of a public launch, Google is releasing it first to a subset of cyber defenders through its Fairwind Program, then widening access in stages. Participating organizations must use phishing-resistant multi-factor authentication and limit access to internal security, incident response or penetration testing teams.
Google built Carbon around the three jobs a security team does: find a flaw, prove it can be exploited, and fix it. It reports scores of 88.2% on SEC-bench Pro for discovery, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. It also sits at the top of the Artificial Analysis Intelligence Index v5.0 with a score of 59.
Read the fine print
Those cybersecurity scores are Google's own, and Google says the evaluations ran without guardrails. Outside developers can't test the model yet, and there's no public release date. The defenders-first rollout is a sensible precaution, but it's also an admission: a model that's excellent at finding bugs is excellent at finding them for anyone.
Why this changes the math for small businesses
For years, the main protection for a small business website was obscurity. Finding a serious flaw took skill and time, so attackers saved their effort for big targets. AI collapses that cost. If models can surface decade-old bugs in core web software, they can also scan thousands of small sites looking for the ones that never updated. The gap between a patch landing and an exploit circulating keeps shrinking.
The flip side is an opening. AI-powered security auditing, patch management and monitoring for small and mid-sized businesses is turning into a real market, and the capabilities defenders get first will reach smaller security firms over time.
Patch first, then pay attention
If your site runs on PHP, which includes most WordPress installs, the first move is simple: confirm you're on a patched release (PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12) or ask your hosting provider to confirm it in writing. After that, treat security updates as same-week work rather than whenever-there's-time work, because the window between disclosure and attack is getting shorter. For founders in or near the security space, this is a moment to study closely: the biggest AI labs are pouring resources into AI-driven defense, and whoever packages those capabilities into simple, affordable services for companies without a security team will have no shortage of customers.
Leave a comment