SURVIVING THE AI APOCALYPSEA Field Guide for People Who Remember VCRs
Your Business · Field guide No. 014 · October 27, 2026

How to Protect Your Small-Business Website From AI-Powered Hackers: 5 Questions to Ask

The hackers' robots don't care how small you are. That's the problem, and the opportunity.

Difficulty
Get help
Time
One email, then a follow-up
Saves
Your shop, your customers' trust
Tools
Email to your web designer, host or IT helper; optional: any chatbot to draft the email

What happened

The AI hacking spree Reuters reported on October 19 went after websites, mostly online shops in the US, Canada, Australia and Japan. The researcher who found the hacker's control panels says the aim appeared to be lasting access to shop and payment systems. Big names were hit, but the agents didn't pick by size; they tried everyone.

Two days later, the security firm Wiz disclosed two serious flaws in PHP, the software behind roughly 7 in 10 websites, including many small-business sites and online shops built on common platforms. PHP released fixes on October 21, and Wiz credits AI tools with helping find the holes. The FBI and NSA advised taking systems offline if they can't be updated promptly, and on October 26 the US cyber agency CISA said attackers are now using the flaws.

Most small-business owners don't run their own servers, and shouldn't. But you can make sure the person who does has done the basics. The FTC's free small-business cybersecurity guide covers the same ground.

What to do

  1. "Is everything updated?" The site software, every plugin and theme, and PHP itself if your site uses it. Ask specifically whether the October 21 PHP fixes are installed (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35). Sites on very old PHP versions won't get a fix at all and need upgrading.
  2. "Is two-step login on for every admin?" Every account that can change the site or the shop, including yours.
  3. "Are backups automatic, and have we tested one?" A backup nobody has ever restored is a hope, not a backup.
  4. "Who handles card payments?" The answer you want: the payment provider handles checkout and card numbers never sit on your server.
  5. "Who gets alerted if something changes?" New admin accounts, changed files or a site that goes down should ping a real person.
  6. Then clean house. Remove old admin accounts, ex-employees' logins and any plugin nobody uses.
The prompt

The prompt

I run a small business with a website [and online shop] built on [platform, e.g. WordPress with WooCommerce, Shopify, Squarespace, not sure]. Write a short, friendly email to [my web designer / hosting company / IT helper] asking them to confirm, in plain English:
1. The site software, plugins and PHP are fully updated, including the October 2026 PHP security fixes.
2. Two-step login is on for every admin account.
3. Backups are automatic, and when one was last test-restored.
4. Card payments are handled by the payment provider, not stored on our server.
5. Who gets alerted if the site changes or goes down.
Also ask them to remove old admin and ex-employee accounts. Keep it under 200 words and not accusatory.

If your site is on a fully hosted platform, some answers will be 'the platform handles that.' That's a fine answer; ask them to confirm it.

Where it still needs a grown-up

  • If you think your site has already been broken into, don't try to fix it yourself: call your web person or host, and if customer card data could be involved, call your payment provider.
  • Data breaches can carry legal duties to notify customers, which vary by state. That's a question for a lawyer, not a chatbot.
  • Never email passwords or admin logins to anyone, including your web person; use the platform's own way of adding a user.

The verdict

You don't need to understand the answers. You need someone to have them.

Sources