19:03Mark Kashef · Tutorial
Your Claude and Codex Setup Is a Mess (Here's the Fix)
A screen-share essay on auditing a bloated Claude and Codex setup, then rebuilding it around one shared AGENTS.md file and a recurring cleanup habit.
October 17thThe argument in one line.
A decade-old flaw in PHP, found with AI help, lets attackers take over the server behind older WordPress sites before any plugin can stop them, and you can check your exposure in minutes.
Read if. Skip if.
READ IF YOU ARE…
- You run a business site on an older WordPress install that an agency or freelancer built and nobody has logged into since.
- You manage websites for clients and need a fast way to check whether their PHP version is exposed.
- You are non-technical and keep hearing about this PHP bug but do not know what PHP or WordPress has to do with your site.
SKIP IF…
- Your site runs on Shopify, Wix, or Squarespace, where the platform most likely handled the fix for you.
- You want a technical write-up of the exploit itself, since this video stays in plain language and does not cover the vulnerability internals.
The full version, fast.
A bug in PHP, the code behind about 7 in 10 websites, can let an attacker take over a site's server with no password, and it fires before WordPress security plugins load. OpenAI found it by proactively stress testing, and it sat unproven for over a decade because verifying it took too much manual work. Governments in Finland and the Netherlands took sites offline. To check your site, feed OpenAI's phpzshell-checker repo to Claude, Codex, or Gemini with a plain-English prompt, then confirm your host's PHP version. Version 8.1 or lower means upgrade or confirm your host patched it.
Free for members
Chat with this breakdown — free.
Sign in and you get 23 free chat messages on us — ask for the hook, quote a framework, find the exact transcript moment, generate a markdown action plan. Bring your own key when you want unlimited.
Create a free account →Lines worth screenshotting.
- The PHP bug is in the language itself, so it can trigger before WordPress loads and bypass every security plugin you installed.
- Roughly 7 out of 10 websites run on PHP, which is why one flaw there reaches so much of the web.
- The bug existed for more than a decade because proving it was exploitable took too much manual work, not because nobody looked.
- AI can map the blast radius of hard-to-prove vulnerabilities, but attackers started using the disclosure the moment it was released.
- Finland and the Netherlands took government web services offline as a precaution, which shows how seriously this was treated.
- Shopify, Wix, and Squarespace sites are most likely already patched, so the real risk sits with small-business sites nobody has logged into for years.
- A checker result of unknown does not mean you are safe, so confirm the PHP version in your hosting settings.
- If your host reports PHP 8.1 or lower, you either need to move to a newer version or confirm the host has backported the fix.
- You can hand an AI coding tool a repo URL and a plain-English prompt, and it will run the check and explain the results for you.
- AI is a double-edged sword in security: the same models that find old bugs for defenders also help attackers break into systems.
- Expect more bugs like this, because labs with large AI budgets can keep stress testing code that has been trusted for years.
Check your PHP version before attackers do
WHAT TO DO
A flaw in PHP can bypass WordPress protections entirely, so the fastest defense is an AI-run check plus a look at the PHP version your host reports.
- Know what powers your site: WordPress runs on PHP, and a bug in PHP sits underneath every plugin and security setting you added on top.
- Sites on Shopify, Wix, or Squarespace are probably covered by the platform, while forgotten freelancer-built sites are the real exposure.
- Give an AI coding tool OpenAI's phpzshell-checker repo and your domain, and ask for the findings in plain English so you can act on them.
- Treat an unknown result as unresolved, then log into your host and read the PHP version directly from its settings.
- If the version is 8.1 or lower, upgrade or get written confirmation from your host that the fix was backported.
- Send the repo and this check to anyone running an older WordPress site, and expect more long-hidden bugs to surface as AI keeps stress testing old code.
Terms worth knowing.
- PHP
- A server-side programming language that runs about 7 in 10 websites, including most WordPress sites. It is the engine that builds each page when a visitor requests it.
- WordPress
- A popular website builder that runs on PHP. Many small business sites were built on it before AI coding tools existed.
- Remote code execution
- A flaw that lets an attacker run their own commands on your server from the internet, effectively taking control of the machine without logging in.
- phpzshell-checker
- An OpenAI repo on GitHub that tests whether a site is vulnerable to this PHP bug. You point an AI coding tool at it and give it your domain.
- Blast radius
- How far a vulnerability reaches if exploited, meaning which systems and how many sites are affected.
Word for word.
Read-along
Don't just watch it. Burn it in.
See every word as it's spoken — crank it to 2× and still catch all of it. The same dual-channel trick behind Amazon's Kindle + Audible.
If you have a website for yourself or your business, especially if it's on an older WordPress site, there's a bug that OpenAI helped expose that you should know about. It's specifically in PHP, which if you're non -technical, is typically the code running on 7 out of 10 websites on the internet today. Now the main threat here is that this bug could let someone take over the computer that your site runs on without having to use a password or any credentials.
So in this video, I'm going to quickly walk you through what this is, why people are worried about it and how to check your own site or a client site in under two minutes. So if you've ever built a website pre vibe coding times, then you've probably heard of something called WordPress. The majority of WordPress based sites run on PHP and for all intents and purposes, you can think of PHP as the main engine driving that.
site underneath the hood. The bug that's been found is in PHP itself. So someone could theoretically send your website a few specialized requests that would allow them to take over the very computer that you run it on.
Again, without ever logging in. And what makes this vulnerability more serious is that it can load before WordPress ever has a chance to even look at the request. So if you have special plugins or settings within WordPress to protect yourself, they don't get a chance to load before this does, meaning in plain language that they can't necessarily stop it.
Now, if you don't have a website, know what WordPress or PHP is, you might ask, why is there so much attention going towards this bug? The main reason is, again, most of the web existed before vibe coding time. So a lot of it was built on the bedrock of PHP.
And to be proactive, a lot of vendors, sites, and governments are taking down their websites to try to avoid any form of catastrophe. And an example of this is that governments in places like Finland, the Netherlands, and a few others have already taken down some of their websites to avoid any form of risk.
Now the interesting part here is we typically hear about companies like OpenAI and Anthropic in a different light when they talk about how their agents are breaking out or breaking into sandboxes, or when they hack into something like Hugging Face apparently. But the nuance here is that OpenAI uncovered this by trying to be proactive, and this is a bug that's existed for more than a decade.
But the reason it sat for a decade was it would take way too much manual work to prove if it was an actual vulnerability and to what extent. So the good thing is obviously that AI can map out the blast radius of these harder to prove vulnerabilities. But the negative side is that the moment that this was released, attackers tried to take advantage of it.
And there are many websites, possibly yours, that could be still compromised. And if you've kept your tabs on the space for the past couple of weeks, if you saw my last video just a few days ago, I walked through other use cases of... how AI is helping not necessarily defend against, but break into different types of systems, coding tools, et cetera.
So AI acts very much as a double -edged sword in the realm of cybersecurity. If your site is on something like Shopify, Wix, or Squarespace, then most likely they've taken care of a lot of this for you. The sites I typically worry about are the ones that a lot of small businesses typically have, where you had something like an agency or a freelancer put it together, and nobody, including that freelancer, has logged in ever since.
If you're on WordPress, you're going to have to do a little bit more work, and I'll show you an easy -to -use repo that OpenAI released that you can just plug into your Clog, Codex, or Gemini and have it fix it for you. To quickly check if your site's affected, you can go to... OpenAI's repos and then go to this one called PHP to Shell.
I'll make sure to include a link down in the description below. You can then just take the URL as is, feed it to your LLM of choice and give it this prompt. Use OpenAI's free PHP to Shell checker at this link right here.
And then you want to throw your domain right here, download it, run the website against my site only, and then tell me in plain English what it found. And then it specifies the exact issues. And if it's unclear for whatever reason, it can help you draft a message to your provider to try to resolve it as soon as possible.
possible. So let's take two sample sites, test A and test B. One of them has a vulnerability.
Once you go and install this repo, what cloud will do on your behalf is something like this. So your AI tool will run something just like this. And then once it runs the results, it'll see right away whether or not it's vulnerable and if it's the wrong or the right version of PHP that needs to be updated.
If you see the word unknown, then you're not necessarily 100 % in the clear, so make sure you do your own due diligence. A better way is to log in or have your AI use computer use to log in to wherever you host your website and check the PHP version. which is typically hidden away in some settings.
If that version starts with 8 .1 or lower, you either need to move to a new version or double check that your host has fixed it. Now, unfortunately, this is going to be one of many types of bugs because companies like OpenAI, Anthropic, and Gemini now have all the resources and the AI models that can keep checking and stress testing possible vulnerabilities just like this.
So this is probably not the last time you're going to hear about some bug out of nowhere that's existed for a long time that you now have to worry about. If you know someone who runs their business on something like an older WordPress site, then I'd highly suggest you send them that GitHub repo and or this video just to help them out.
And like I've said before, I'm going to continue touching on some cybersecurity related topics because again, I think that this is going to be one of the most important things for the coming future to make sure that you're as armed and protected and informed as possible for everything that's about to come. As always, if you found this video helpful, I'd super appreciate a like and a comment on the video and I'll see you in the next one.
The Hook
The bait, then the rug-pull.
Most of the web was built on PHP before vibe coding existed, and a bug found with OpenAI's help can hand an attacker the server under an older WordPress site. This video shows what it is and how to test your own site fast.
