AI hacking has made website attacks faster and cheaper to run. AI tools now help find software security flaws in record numbers, and attackers can start using a new flaw within days of its fix, sometimes within hours. A business website with outdated plugins, or one that nobody updates, is a much easier target than it was before ChatGPT.
Digital Consulting is a Cape Town agency for web design, SEO and AI visibility. We repair hacked websites for South African businesses, and in October 2026 we moved our own website off WordPress for the reasons in this article. Every figure below was checked on 29 October 2026.
What AI hacking looked like in October 2026
On 21 October 2026, PHP released fixes for two critical flaws that researchers nicknamed PHP2Shell. PHP is the programming language behind 69.3% of websites whose server language is known, including every WordPress site. Both flaws let an attacker with no password run their own code on the server. Calif and Wiz, two of the security firms that reported them, have both said they used AI models in their research.
Amazon saw the first attack attempt on 17 October, four days before the flaws were made public, and broad attacks followed once the fixes came out. Amazon's security team gave one reason: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit." The UK's National Cyber Security Centre told organisations that could not update in time to consider taking their systems offline.
xneelo patched the server that hosts our website on the day the fixes came out. Sites on PHP 8.1 or older have a bigger problem: those versions got no official fix, so they need a PHP upgrade first.
AI and cyber security: what changed after ChatGPT
ChatGPT was released on 30 November 2022. Since then, two things have changed for anyone who runs a website: how many security flaws are found, and how fast attackers use them.
CVE records are the public list of known software security flaws. CVE.org's figures show 16,512 published in 2018 and 25,059 in 2022, a rise of about half in four years. By 2025 the yearly count had nearly doubled again, to 48,244. In the first nine months of 2026, 72,812 were published, 51% more than in the whole of 2025.
AI tools are behind part of the 2026 jump. In June, Help Net Security reported that AI tools "have started hunting for software flaws on their own", naming models from Anthropic and OpenAI. Between 1 January and 23 October, records that credit an AI system as the finder went from 34 in 2025 to 769 in 2026. Most software makers don't say who found their bugs, so AI's full share is unknown. More software and better record-keeping add to the count as well.
Speed has changed even more. Mandiant, Google's incident response team, measures the average time between a fix being released and attackers using the flaw. It was 63 days in 2018 and 2019, 32 days in 2021 and 2022, and 5 days in 2023. For 2025, Mandiant estimates minus 7 days: on average, attackers were using flaws before a fix existed. On WordPress, Patchstack found that the most-attacked flaws of 2025 were exploited 5 hours after they were made public, going by its weighted median. If you update your plugins once a month, that leaves weeks in which a known flaw is open on your site.
AI is now doing the hacking
In September 2025, Anthropic caught a group it believes was Chinese state-sponsored using its Claude Code tool against about 30 organisations. The AI did 80 to 90% of the work, and at its peak it made thousands of requests, often several a second. In July 2026, OpenAI said two of its own AI models attacked Hugging Face, an AI company, using stolen credentials and a security flaw nobody knew about.
For small business websites, the worry is scale. The same AI tools make it cheap to test thousands of websites for a flaw that is only a few hours old.
Cybercrime in South Africa: the local numbers
Advice on cyber security in South Africa tends to focus on email and banking scams. A business website faces the same attackers, and it is online all day. INTERPOL's Africa Cyberthreat Assessment Report 2026 found that:
- South Africa had 92% of all ransomware detections in Africa, going by TrendAI's data
- 70% of the continent's business email compromise detections in 2025 came from South Africa
- South Africa had 43.6% of the exploitable vulnerabilities the Shadowserver Foundation found across Africa in 2025
- in INTERPOL's survey of member countries, 55% of cybercrime cases in 2025 involved AI in some way
Sophos's State of Ransomware in South Africa 2026 found that exploited vulnerabilities started 25% of the ransomware attacks it studied, second only to stolen login details at 27%. Sophos also warns that "Frontier AI is accelerating vulnerability discovery and exploitability."
More South African businesses are reporting breaches as well. The Information Regulator received 2,374 security compromise notifications in the 2024/25 financial year, and it says notifications could pass 3,000 in 2026/27. If a hack exposes personal information, such as customer details from a contact form or online shop, section 22 of POPIA requires you to tell the Regulator and the people affected as soon as reasonably possible.
Why WordPress websites are hit hardest
WordPress runs 39.5% of all websites, so one flaw in a popular plugin gives attackers millions of possible targets. Patchstack's 2026 report counted 11,334 new security flaws in WordPress and its add-ons in 2025, 42% more than in 2024, and 91% of them were in plugins. Nearly half (46%) had no fix from the plugin's developer when they were made public. In Patchstack's tests, standard hosting defences blocked only 12% of attacks on WordPress flaws.
Plugins can also be attacked through the company that makes them. In October 2026, attackers broke into TeamUpdraft, the company behind the UpdraftPlus backup plugin, and used its customers' connection keys to plant backdoors on their WordPress sites. TeamUpdraft said the speed of the attacks and the faulty first versions of the backdoors "suggest that the hackers used AI to accelerate their attack."
Static website vs WordPress: less for an attacker to reach
A static website is a set of ready-made pages. There is no login page, database or plugin on the live site for an attacker to break into. Digital Consulting rebuilt digitalconsulting.co.za this way and kept all 572 of its web addresses, so Google still finds every page. The old WordPress login address now shows a "page not found" error.
| Custom-coded static site | WordPress site | |
|---|---|---|
| Login page on the website | None | Yes |
| Database | None | Yes |
| Plugins to keep updated | None | Usually several |
| What still needs patching | The server | WordPress, plugins, theme and server |
A static site still needs care. Our forms and our free hack check run on PHP, so our server needed the PHP2Shell fix too. Your hosting, domain and email accounts need strong passwords and two-factor login whatever your website is built with.
Static sites suit business websites that change a few times a month, such as service pages, a blog and contact forms. WordPress is still the better tool for online shops and for sites that are edited every day. Digital Consulting moves websites off WordPress from R4,500 once-off, priced on how complex the site is.
Website security: what to do this month
If your website runs on WordPress, or on any system with plugins:
- Run a free website security check. Digital Consulting's hack check looks for hidden spam links, redirects and harmful scripts in about ten seconds.
- Ask your host which PHP version your site runs, and whether it has the 21 October 2026 fixes. In WordPress, the version is under Tools > Site Health > Info > Server.
- Update WordPress, every plugin and every theme, and delete plugins you don't use.
- Turn on two-factor login for your website, hosting and domain accounts.
- Remove admin users and plugin connection keys you no longer need. The TeamUpdraft attack came in through keys like these.
- Keep backups outside your hosting account, so you can restore a clean copy.
Frequently asked questions
Can AI hack a website?
Yes. AI tools can now find security flaws and write working attacks, and in documented cases they did most of the work themselves. Anthropic reported a campaign in which AI did 80 to 90% of the hacking. For a small business website, the main risk is automated attacks on every site that runs the same unpatched plugin.
How do websites get hacked?
Most websites are hacked through software with a known flaw: an outdated plugin, theme, content management system or server. Others are broken into with stolen or weak passwords. In 2025, 91% of new WordPress flaws were in plugins (Patchstack), and attackers used the most-targeted ones within hours of them being made public.
Is WordPress secure?
WordPress itself is well maintained, but a typical site also depends on a theme and many plugins from different developers. Each one needs updates, and 46% of new WordPress flaws in 2025 had no fix when they were made public (Patchstack). A single outdated plugin can let an attacker in.
How do I check if my website has been hacked?
Look for strange redirects, Google warnings, new admin users, or pages you didn't create. Many hacks hide links to casino and betting sites that you won't see on the page. A free website security check, such as Digital Consulting's hack check, scans your public pages for these signs in about ten seconds.
What should I do if my website is hacked?
Change every password linked to the site, tell your host, and have the site cleaned or restored from a clean backup. Then close the way in, or the attacker will return. If customer data was exposed, POPIA requires you to notify the Information Regulator. Our website hack recovery guide has more detail.
Want help securing your website?
Digital Consulting cleans hacked websites, keeps WordPress sites patched, and rebuilds business websites as custom-coded sites with far less to attack.
- Website hack fix and malware removal: from R1,500, priced on how deep the hack goes.
- Move off WordPress to a custom website: from R4,500 once-off.
- Website maintenance and support: updates, backups and security checks from R990 a month.
Last updated: 29 October 2026. Figures checked on 29 October 2026. This article is not legal advice.
