URGENT: AI Found a Hole in 70% of Websites. Check Yours in 2 Minutes
Read the Portuguese translation →
Author: Hyperautomation Labs · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: URGENT: AI Found a Hole in 70% of Websites. Check Yours in 2 Minutes · Channel: Hyperautomation Labs · 03:43 · Watch on YouTube
Topics: AI agents, Cybersecurity and software security, Claude Code, AI developer tools
Summary
Section titled “Summary”The video describes two serious vulnerabilities in PHP that may let unauthenticated attackers run code on affected websites, and says attacks have already begun. It explains how to check a site’s PHP version and lists the patched versions for PHP 8.2 through 8.5, noting that PHP 8.1 and older have no official fix. Shared-hosting customers are advised to verify their provider has updated PHP, while server operators are shown an example of updating a Docker site with an AI coding agent. The video warns that disabling error messages is not a fix and cautions against downloading exploit-checker scripts.
Key points
Section titled “Key points”- The vulnerabilities affect PHP, which underlies platforms including WordPress, Drupal, and Joomla.
- The transcript says an attacker could send a request and run code without logging in.
- Both bugs are rated 9.2 out of 10 and had been present in PHP for at least a decade.
- The video credits AI models used in research that helped demonstrate the bugs could take over a WordPress site.
- Check the PHP version in WordPress under Tools, Site Health, Info, and Server.
- The stated minimum patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- The video says PHP 8.1 and older have no official fix and recommends moving up.
- Shared-hosting users should check their hosting panel and contact support if their PHP version is not patched.
- For self-managed servers, the video demonstrates using Claude Code to update a Docker image and keep the old container stopped for rollback.
- Disabling error messages does not protect a site; the video also warns that exploit-checker scripts may be fake or carry malware.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The PHP vulnerabilities and why they matter | The video introduces the PHP bugs, their potential impact on websites, and the role AI played in helping researchers validate them. |
| 01:35 | Check your PHP version | The video shows where WordPress users can find their PHP version and lists the minimum patched versions. |
| 02:11 | What hosting customers and server operators should do | The video advises shared-hosting users to verify their provider’s update and demonstrates updating a Docker site with Claude Code. |
| 03:13 | Warnings and checklist | The video stresses that updating is the fix, warns against suspicious checker scripts, and points viewers to its checklist. |
Quotes
Section titled “Quotes”the PHP team says updating is the only safe choice. — 00:00
A stranger could send a request to your site and run their own code on it without logging in. — 00:31
If you’re on 8.1 or older, there’s no official fix at all. — 02:11
Turning off error messages does not protect you, only the update does. — 03:13
Concepts and entities
Section titled “Concepts and entities”PHP to shell, PHP, WordPress, Wiz, Gemini, GPT, Cloudflare, Claude Code, Docker
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 AI models just found a hole in the software behind about 70% of the world’s websites and attacks have already started. It’s called PHP to shell and the PHP team says updating is the only safe choice. By the end of this video, you’ll know if your site is affected and how to fix it in about 2 minutes even if you’ve never touched a server. Here’s what happened simply. PHP is the engine underneath most websites. WordPress runs on it, so do
00:31 Drupal, Joomla and millions of online stores. Researchers found two bugs in that engine itself, so it doesn’t matter which plugins you use or how strong your password is. A stranger could send a request to your site and run their own code on it without logging in. Both bugs are rated 9.2 out of 10 and they’ve been sitting in PHP for at least a decade. And this is why it’s blowing up. Security firm Wiz says it used frontier AI models, Google’s Gemini and Open AI’s GPT throughout the research. From finding the bugs to testing the fix. One
01:03 of these bugs was actually spotted in a security audit back in 2024 and nobody fixed it. This time AI helped researchers prove the bugs could really take over a WordPress site and that was enough to force a patch. That’s the new reality. AI is finding old holes faster than ever for the good guys and the bad guys. And why it’s urgent today? The details leaked online before the fix was out, so PHP rushed the release a day early and Cloudflare says it’s already seeing early attacks. If this video is useful,
01:35 hit subscribe because it’s free. And if you want to back the work here, join or the supporter button on Facebook. Now, let’s check your site. Step one, find your PHP version. If you’re on WordPress, go to tools, site health, info, then server and you’ll see it right there. On this test site, it says 8.4.25, which is not patched. Now, compare yours to this guide. If you’re on 8.5, you need 8.5.12 or higher. 8.4 needs .27, 8.3 needs .36,
02:11 and 8.2 needs .35. If you’re on 8.1 or older, there’s no official fix at all. So, this is your sign to move up. If you’re on shared hosting, the good news is most hosts are patching this for you. SiteGround, for example, says it moved early to protect its customers. But, don’t assume. Open your hosting panel, find the PHP version page, and make sure you’re on the newest version they offer. If it’s still not on the fixed list, send them a support ticket today. I put the exact wording in the free checklist.
02:42 If you run your own server or VPS, this is where an AI agent earns its keep. Here’s a small bakery website running in Docker, and its server header says PHP 8.4.26, not patched. I gave Claude Code one request. Check if this is affected by PHP to shell, and if it is, update it safely. In about 25 seconds, it read the setup, confirmed 8.4.26 is older than the fix, switched the image to 8.4.27, rebuilt it, and swapped the container. It even kept the old one stopped, so I can roll back.
03:13 Same check again. PHP 8.4.27, patched, and the site still loads. Two quick warnings. Turning off error messages does not protect you, only the update does. And don’t download any exploit checker scripts going around right now. Some of them are fake and may carry malware. Use your version number and your host. I made a 2-minute checklist with the exact versions, what to do on shared hosting, WordPress, or your own server, and the stopgap settings if you can’t update today. Comment patch and I’ll send it to you.
03:43 Follow along on Instagram and Facebook for bite-size AI and the deep dive playbooks live here on YouTube. So, subscribe so you don’t miss one.