Book a call
Services
Services overview → Build for AI Web Design & Development Web Applications & Dashboards MVP & Prototype Development Full Production Applications Platform Integrations & Third-Party Apps Website Conversion Optimization Infrastructure, Hosting & DevOps Framework Conversion & Migration Marketing for AI AI Search Visibility AI Content & Ads Ops AI Marketing Automation Custom MCP Infrastructure Infrastructure for AI Compute Engine Cloud Run Cloud Functions Cloud Storage Cloud SQL Cloud IAM Google Kubernetes Engine Cloud Logging & Monitoring
Industries
Industries overview → Trades & Construction Websites for plumbers, electricians, builders, and roofers that turn searches into quote requests. Hospitality Websites for restaurants, cafés, pubs, and B&Bs with menus, bookings, and opening hours that are always right. Health & Beauty Websites for salons, barbers, clinics, and physios with online booking and treatment menus. Professional Services Websites for solicitors, accountants, consultants, and architects that build trust and win enquiries. Retail & E-commerce Online shops for local retailers and makers, with payments, delivery, and click-and-collect.
Pricing
Resources
Case Studies 21 real engagements with before → after metrics. Blog Practical guides on GEO, SEO, MCP servers, and cloud. Guides Ireland-focused guides on websites, AI search, and cloud.
About Contact Log in
Blog

The PHP Flaw That Threatened 70% of the Internet: Ireland's Wake-Up Call

November 8, 2026 · BuiltBrilliant SecurityWordPressPHP
The PHP Flaw That Threatened 70% of the Internet: Ireland's Wake-Up Call

In October 2026, security researchers using AI uncovered critical PHP flaws, reported as threatening a large share of the internet, and Irish companies and government bodies stepped up cyber defences in response. If your website runs WordPress, which 39.5% of all websites do per W3Techs data from 29 October 2026, this story is about you.

Why PHP flaws matter so much

PHP powers WordPress, and WordPress powers a huge share of the web, which makes any PHP vulnerability a mass event: one flaw, millions of affected sites, automated exploitation within hours of disclosure. The 2026 episode was also a milestone for a different reason: AI did the finding. Automated vulnerability research is now good enough to discover critical flaws at scale, which means the gap between disclosure and exploitation keeps shrinking.

What Irish businesses should do this week

  1. Patch everything, now. Operating system, PHP, WordPress core, and every plugin. Automated patching, not monthly manual.
  2. Delete what you do not use. Every unused plugin is attack surface that nobody updates.
  3. Turn on MFA on every admin and hosting account.
  4. Check your backups. If you get hit, recovery is a restore, and the 3-2-1 rule is the difference between an afternoon and a catastrophe.

The full checklist is our website security guide.

The structural fix

The uncomfortable truth: a plugin-based site is a maintenance commitment forever, and most Irish SMEs do not maintain. That is why the serious answer to the PHP flaw story is not another security plugin, it is reducing the attack surface itself. Static builds have no PHP, no plugins, and no login page for bots to hammer, which is the argument we made in our WordPress migration guide, and the working example is our WordPress to Astro case study.

The one-line summary

Patch today, reduce surface this quarter, and treat the next mass flaw as a when, not an if. The businesses that did the October drill will be glad they did.

Read next: Website and app security in Ireland: the 2026 checklist

← Back to blog