PHP got hacked wide open this week - one Claude prompt tells you if you're hit | LAB 0027

PHP got hacked wide open this week - two critical bugs that let anyone take over a PHP server without logging in. the same day LiteLLM 1.107.0 shipped a password stealer, and Railway, where my app runs, got broken into. so i gave Claude one prompt to check my Mac and my websites for all three. PHP: clear. LiteLLM: clear. Railway: hit. Threadify runs on it, and Claude found Railway's warning email sitting unopened in my inbox. we'd already handled it, but that's the one that mattered. also this week: Claude Duet, an agent that comes to you (waitlist, US Pro and Max), Andrew Curran says OpenAI calls the PHP bug the tip of the iceberg, Claude Security now re-scans as your code changes (Enterprise beta), Tibo's reset day, editing with no editor, and the one line that makes your Claude Projects coordinator report in. the practical - check if this week's hacks hit you, in one prompt. paste it into Claude Code and swap in your own websites at the end: This week PHP had two critical bugs (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35), LiteLLM 1.107.0 shipped a password stealer, and Railway asked everyone to rotate their keys. Check my computer and my websites for all three. Only look, change nothing, and never show me a password or key. Then tell me in plain English: am I affected, how bad is it, and the one thing to do first. My websites: yoursite.com it only looks and changes nothing. the catch: it can only check what it can see, so you still read it with your own eyes. if you run a website, update PHP or ask whoever hosts it if they have. if you use Railway, swap your keys - new one in first, then turn the old one off. want to join the beta of the agentic video editor i'm building? comment Eddy below. links fiveoutofnine on PHP's week: https://x.com/fiveoutofnine/status/2113045722744717360 Claude Duet: https://x.com/claudeai/status/2112984664256241837 Andrew Curran on OpenAI's tip of the iceberg: https://x.com/AndrewCurran_/status/2112913197774807491 Claude Security scans continuously: https://x.com/claudeai/status/2112962248218148878 Alex on editing headless: https://x.com/The_Alex/status/2112708662288625765 Anthony on making your coordinator report in: https://x.com/kr0der/status/2106429105671643587 chapters 0:00 PHP got hacked: am i hit? 2:40 Claude Duet comes to you 4:12 OpenAI: the tip of the iceberg 5:48 sponsor: Threadify 7:07 Claude Security keeps scanning 8:17 Tibo's reset day 8:56 editing with no editor 10:14 make your coordinator report in 12:11 check if you're hit, in one prompt thanks to today's sponsor, my software Threadify - your lead generation agent for Threads, X and YouTube: https://www.threadify.app/home?utm_source=youtube&utm_medium=video&utm_campaign=lab-0027&utm_content=sponsor&video_slug=lab-0027&cta_slot=youtube_description&entry_angle=lead_signal want to sponsor a future episode? [e-mail] watch the full episode: https://www.youtube.com/watch?v=l6rSOfIZk_Y

What is Lenny’s AI Builders?

less scrolling. more “oh shit, i could use that.”

i’m Lennox. i dig through the AI updates worth your time, then test tools, models and agents on real work. what worked, what broke, and what you can try yourself.

for people making products, content and useful systems with AI. you don’t need to write code to build something worth using. grab the field notes for prompts, steps and the bits to watch out for: https://lennoxsaint.com/lab

this feed also keeps the earlier L E S S O N S episodes from my journey building with AI.