I went to bed at 3am. The servers are patched. I may need a nap

I'm writing this on very little sleep and a worrying amount of coffee. Last night I patched around 100 websites spread across the best part of 50 servers, and went to bed at 3am. If any of this post doesn't make sense, that's why.

The culprit was PHP2Shell, the two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that I wrote about yesterday. The fixes came out at 3pm. My evening plans went out of the window at about 3:01.

AI giveth, and AI taketh away

There's a certain irony to all this. The way I see it, AI is a big part of why holes like this are coming to light so fast now. The tools are very good at reading code and spotting the bit where it goes wrong.

The flip side is that AI is also why I was in bed at 3am and not 3am the following Tuesday.

Some of these servers were running versions of PHP old enough to remember dial-up. You can't just patch those. The fix doesn't exist for them, so the only way out is to build a new server, move every site and database across, and fix all the code that breaks on the way. Normally that's days of work per server. Last night it was hours.

AI read the old code and found what would break on the newer PHP. It wrote and tested the fixes. It did the tedious checking, page by page, that the new server gave back exactly the same thing as the old one. It never once asked if it could go home.

You still need someone who knows what they're doing

Here's the bit the AI evangelists tend to skip.

AI was brilliant last night, but it was brilliant in the way a very fast, very keen apprentice is brilliant. It needed someone to tell it which servers mattered, what "done" looked like, and when to stop. It needed someone to say "no, don't touch that one, a client is mid-order" and "check the payment emails still go out".

A couple of times it was confidently, cheerfully wrong. Spotting that takes years of having broken Linux servers yourself, usually on a Friday afternoon.

So the honest summary is this. AI didn't replace the server person. It made the server person about ten times faster. That's a very different thing, and it matters if you're a business owner wondering whether you still need one.

If your server still isn't sorted

Plenty of servers out there are still running unpatched PHP today, often because they're too old to patch and nobody quite knows what's on them. If that sounds like yours, or you've had an email from your security plugin telling you to "contact your hosting provider" and you suspect that's you, I can help.

I'm available, I know my way around a Linux box, and I promise to be more awake by the time you call.