# Is WordPress safe after PHP2Shell? Our take

ID: youtube:cxACne9TxEM
Canonical HTML: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take
Original source: https://www.youtube.com/watch?v=cxACne9TxEM
Author: Attribution unresolved
Published: 2026-10-23T00:00:00.000Z
Source checked: 2026-10-26T04:00:25.839Z
Language: en
Directory publisher: Roboto Studio
Text: original source material.

## Original source text

PHP2Shell is a critical PHP vulnerability rated 9.2 out of 10. Why we avoid monolithic WordPress, how a headless Next.js and Sanity stack keeps the surface area small, and the open source starter we use to spin one up.

## Full transcript

Origin: Edited transcript from the original Roboto page

Holy moly, what a day. So PHP has had a critical vulnerability. When you know it's a critical vulnerability is when the FBI gets involved. So if you don't know, basically you have to perform an immediate update, and it's recommended that if you can't perform an immediate update, you should probably take the entire website offline. If you want to know how bad this thing is, the CVSS scale is rated out of 10 and this is a 9.2. So it's pretty bad.

So what I want to talk to you about today is the reason why we build headless and why I would avoid a monolithic system like WordPress, which is PHP based, because of mainly this reason. If you don't know, WordPress has been around for a long, long period of time. I think it's coming up to either its 20th birthday or its 20th birthday's past, and it's been one of the most fundamental parts of blogging on the web for God knows how long. It makes up such a substantial amount of the internet.

However, because it's monolithic, it has a lot of different systems that are involved in it. So you have the logins, you have the plugins, you have a whole host of different things. A lot of people keep their forms in there. They have user management where it's really quite extensive. All of that is handled in a monolithic system.

On the other hand, you have a headless system, and a headless system is usually a website. I'm going to say Next.js because that's the ones that we build, but you could have React Router, you could have Astro, any of these different frameworks. But basically that sits on a very, very narrow surface area versus WordPress, which is a huge surface area. And we'll come back to why that might be a problem in a second.

So in comparison, on headless you get to pick and choose whatever you want as a backend. You get to pick and choose whatever you want as a form or whatever else. All these different functionalities, user management, you can use things like Clerk. All of these things are pick and choose. You pick the best one in the industry and you essentially bolt it on.

Now, why is this important when we say that we're going to use something like a microservice, like in the example of a CMS, like Sanity or Contentful or, God forbid you're stuck with it, Prismic? Any of these situations, why would you be choosing one of these over WordPress? Because WordPress does everything, right? Well, the reason why is because they have to manage the security. So for example, for Sanity, if Sanity was built in PHP, this is Sanity's problem now, not your problem, because they have lots of enterprise clients and they need to make sure that they don't tick those guys off that are paying hundreds of thousands, millions of dollars. Whereas you have one IT team that needs to sort this out. You might not even be lucky enough to have an IT team. You've got Dave down the hallway that runs WordPress in your team. So you've got to be very careful, because when a zero day like this happens, that needs to get solved fast.

Because there's a smaller surface for headless, there's a lot less chance of getting hacked, of having vulnerabilities happen that are as catastrophic as what's just happened here. Whereas the surface of WordPress is massive, and this vulnerability is really, really bad. Those two things work together to be completely catastrophic.

Now, if you're looking at moving away from this and you're looking at trying to build your first website that is headless, we actually have a solution just for you. Let me show you this. This is our own open source system called Turbo Start Sanity, and we basically released this into the open. So it's got all the best licenses you could ask for. There's nothing like a clawback clause or any nastiness like that. It's full MIT licensing, so you can use this for your own business today. But this here is the best Next.js, the best Sanity and the best Vercel, in our opinion. The Vercel part, you can switch it out to AWS or you can switch it out to Cloudflare.

This particular system makes it very easy for you to spin up and basically vibe code your own website. Obviously, get us in towards the end and make sure that you've got it set up properly. But at the end of the day, this is what I would recommend right now, because the vulnerabilities shrink to an absolute minute scale versus the WordPress PHP meltdown. And it's extremely fast, extremely scalable, and then you can start tacking on what you want as extra features on the website.

So I hope this was interesting. Tell me how you're getting on at the minute. If anybody's having any issues with PHP or issues with hosting or all this kind of stuff, drop us a message below. We'll see if we can help you out. Take care. Bye bye.

## Timestamped captions

### segment-1
[3.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=3)
Holy moly, [laughter]

### segment-2
[3.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=3)
Holy moly, [laughter]
what a day. So, PHP has had a critical

### segment-3
[7.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=7)
what a day. So, PHP has had a critical

### segment-4
[7.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=7)
what a day. So, PHP has had a critical
vulnerability. When you know it's a

### segment-5
[9.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=9)
vulnerability. When you know it's a

### segment-6
[9.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=9)
vulnerability. When you know it's a
critical vulnerability is when the FBI

### segment-7
[11.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=11)
critical vulnerability is when the FBI

### segment-8
[11.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=11)
critical vulnerability is when the FBI
gets involved. So, if you don't know,

### segment-9
[14.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=14)
gets involved. So, if you don't know,

### segment-10
[14.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=14)
gets involved. So, if you don't know,
basically, you have to perform an

### segment-11
[15.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=15)
basically, you have to perform an

### segment-12
[15.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=15)
basically, you have to perform an
immediate update. And it's recommended

### segment-13
[17.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=17)
immediate update. And it's recommended

### segment-14
[17.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=17)
immediate update. And it's recommended
that if you can't perform an immediate

### segment-15
[19.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=19)
that if you can't perform an immediate

### segment-16
[19.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=19)
that if you can't perform an immediate
update, you should probably take the

### segment-17
[21.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=21)
update, you should probably take the

### segment-18
[21.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=21)
update, you should probably take the
entire website offline. If you want to

### segment-19
[23.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=23)
entire website offline. If you want to

### segment-20
[23.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=23)
entire website offline. If you want to
know how bad this thing is, the CVSS

### segment-21
[25.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=25)
know how bad this thing is, the CVSS

### segment-22
[25.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=25)
know how bad this thing is, the CVSS
scale is rated out of 10, and this is a

### segment-23
[28.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=28)
scale is rated out of 10, and this is a

### segment-24
[28.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=28)
scale is rated out of 10, and this is a
9.2.

### segment-25
[29.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=29)
9.2.

### segment-26
[29.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=29)
9.2.
So [laughter] it's pretty bad. So what I

### segment-27
[32.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=32)
So [laughter] it's pretty bad. So what I

### segment-28
[32.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=32)
So [laughter] it's pretty bad. So what I
want to talk to you about today is the

### segment-29
[34.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=34)
want to talk to you about today is the

### segment-30
[34.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=34)
want to talk to you about today is the
reason why we build headless and why I

### segment-31
[37.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=37)
reason why we build headless and why I

### segment-32
[37.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=37)
reason why we build headless and why I
would avoid a monolithic system like

### segment-33
[39.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=39)
would avoid a monolithic system like

### segment-34
[39.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=39)
would avoid a monolithic system like
WordPress which is PHPbased because of

### segment-35
[42.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=42)
WordPress which is PHPbased because of

### segment-36
[42.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=42)
WordPress which is PHPbased because of
mainly this reason. If you don't know

### segment-37
[45.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=44)
mainly this reason. If you don't know

### segment-38
[45.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=44)
mainly this reason. If you don't know
WordPress has been around for a long

### segment-39
[46.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=46)
WordPress has been around for a long

### segment-40
[46.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=46)
WordPress has been around for a long
long period of time. I think it's coming

### segment-41
[47.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=47)
long period of time. I think it's coming

### segment-42
[47.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=47)
long period of time. I think it's coming
up to either its 20th birthday or it

### segment-43
[49.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=49)
up to either its 20th birthday or it

### segment-44
[49.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=49)
up to either its 20th birthday or it
20th birthday's past and it's been one

### segment-45
[52.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=52)
20th birthday's past and it's been one

### segment-46
[52.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=52)
20th birthday's past and it's been one
of the most fundamental parts of

### segment-47
[54.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=54)
of the most fundamental parts of

### segment-48
[54.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=54)
of the most fundamental parts of
blogging on the web for god knows how

### segment-49
[55.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=55)
blogging on the web for god knows how

### segment-50
[55.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=55)
blogging on the web for god knows how
long. It makes up such a substantial

### segment-51
[56.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=56)
long. It makes up such a substantial

### segment-52
[56.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=56)
long. It makes up such a substantial
amount of the internet. However, because

### segment-53
[59.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=59)
amount of the internet. However, because

### segment-54
[59.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=59)
amount of the internet. However, because
it's monolithic, it has a lot of

### segment-55
[60.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=60)
it's monolithic, it has a lot of

### segment-56
[60.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=60)
it's monolithic, it has a lot of
different systems that are involved in

### segment-57
[62.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=61)
different systems that are involved in

### segment-58
[62.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=62)
different systems that are involved in
it. So, you have the login, you have the

### segment-59
[65.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=65)
it. So, you have the login, you have the

### segment-60
[65.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=65)
it. So, you have the login, you have the
plugins, you have a whole host of

### segment-61
[68.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=68)
plugins, you have a whole host of

### segment-62
[68.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=68)
plugins, you have a whole host of
different things. A lot of people keep

### segment-63
[69.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=69)
different things. A lot of people keep

### segment-64
[69.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=69)
different things. A lot of people keep
their forms in there. They have user

### segment-65
[71.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=71)
their forms in there. They have user

### segment-66
[71.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=71)
their forms in there. They have user
management where it's really quite

### segment-67
[73.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=73)
management where it's really quite

### segment-68
[73.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=73)
management where it's really quite
extensive. All of that is handled in a

### segment-69
[75.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=75)
extensive. All of that is handled in a

### segment-70
[75.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=75)
extensive. All of that is handled in a
monolithic system. On the other hand,

### segment-71
[77.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=77)
monolithic system. On the other hand,

### segment-72
[77.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=77)
monolithic system. On the other hand,
you have a headless system. And a

### segment-73
[79.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=79)
you have a headless system. And a

### segment-74
[79.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=79)
you have a headless system. And a
headless system is probably usually a

### segment-75
[82.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=82)
headless system is probably usually a

### segment-76
[82.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=82)
headless system is probably usually a
website. I'm going to say Nex.js JS cuz

### segment-77
[83.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=83)
website. I'm going to say Nex.js JS cuz

### segment-78
[83.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=83)
website. I'm going to say Nex.js JS cuz
that's the ones that we build. But you

### segment-79
[85.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=85)
that's the ones that we build. But you

### segment-80
[85.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=85)
that's the ones that we build. But you
could have React Router, you could have

### segment-81
[87.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=87)
could have React Router, you could have

### segment-82
[87.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=87)
could have React Router, you could have
Astro, any of these different

### segment-83
[88.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=88)
Astro, any of these different

### segment-84
[88.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=88)
Astro, any of these different
frameworks. But basically that sits on a

### segment-85
[91.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=90)
frameworks. But basically that sits on a

### segment-86
[91.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=90)
frameworks. But basically that sits on a
very very narrow surface area versus

### segment-87
[94.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=94)
very very narrow surface area versus

### segment-88
[94.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=94)
very very narrow surface area versus
WordPress which is a huge surface area.

### segment-89
[96.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=96)
WordPress which is a huge surface area.

### segment-90
[96.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=96)
WordPress which is a huge surface area.
And we'll come back to why that might be

### segment-91
[97.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=97)
And we'll come back to why that might be

### segment-92
[97.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=97)
And we'll come back to why that might be
a problem in a second. So in comparison

### segment-93
[100.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=100)
a problem in a second. So in comparison

### segment-94
[100.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=100)
a problem in a second. So in comparison
on headless then you get to pick and

### segment-95
[102.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=102)
on headless then you get to pick and

### segment-96
[102.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=102)
on headless then you get to pick and
choose whatever you want as a backend.

### segment-97
[105.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=105)
choose whatever you want as a backend.

### segment-98
[105.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=105)
choose whatever you want as a backend.
You get to pick and choose whatever you

### segment-99
[106.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=106)
You get to pick and choose whatever you

### segment-100
[106.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=106)
You get to pick and choose whatever you
want as a form or whatever all these

### segment-101
[109.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=109)
want as a form or whatever all these

### segment-102
[109.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=109)
want as a form or whatever all these
different functionalities. user uh

### segment-103
[111.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=111)
different functionalities. user uh

### segment-104
[111.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=111)
different functionalities. user uh
management. You can use things like

### segment-105
[112.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=112)
management. You can use things like

### segment-106
[112.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=112)
management. You can use things like
clerk. All of these things are pick and

### segment-107
[114.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=114)
clerk. All of these things are pick and

### segment-108
[114.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=114)
clerk. All of these things are pick and
choose. You pick the best one in the

### segment-109
[116.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=115)
choose. You pick the best one in the

### segment-110
[116.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=116)
choose. You pick the best one in the
industry and you essentially bolt it on.

### segment-111
[119.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=119)
industry and you essentially bolt it on.

### segment-112
[119.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=119)
industry and you essentially bolt it on.
Now, why is this important when we say

### segment-113
[121.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=121)
Now, why is this important when we say

### segment-114
[121.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=121)
Now, why is this important when we say
that we're going to use something like a

### segment-115
[123.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=123)
that we're going to use something like a

### segment-116
[123.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=123)
that we're going to use something like a
micro service like in the example of a

### segment-117
[126.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=126)
micro service like in the example of a

### segment-118
[126.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=126)
micro service like in the example of a
CMS like Sanity or Contentful or God

### segment-119
[129.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=129)
CMS like Sanity or Contentful or God

### segment-120
[129.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=129)
CMS like Sanity or Contentful or God
forbid you're stuck with it, but

### segment-121
[130.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=130)
forbid you're stuck with it, but

### segment-122
[130.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=130)
forbid you're stuck with it, but
Prismic, any of these situations, why

### segment-123
[133.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=133)
Prismic, any of these situations, why

### segment-124
[133.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=133)
Prismic, any of these situations, why
would you be choosing one of these over

### segment-125
[136.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=136)
would you be choosing one of these over

### segment-126
[136.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=136)
would you be choosing one of these over
WordPress? Because WordPress does

### segment-127
[137.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=137)
WordPress? Because WordPress does

### segment-128
[137.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=137)
WordPress? Because WordPress does
everything, right? Well, the reason why

### segment-129
[140.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=140)
everything, right? Well, the reason why

### segment-130
[140.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=140)
everything, right? Well, the reason why
is because they have to manage the

### segment-131
[142.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=142)
is because they have to manage the

### segment-132
[143.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=142)
is because they have to manage the
security. So, for example, for Sanity,

### segment-133
[145.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=145)
security. So, for example, for Sanity,

### segment-134
[145.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=145)
security. So, for example, for Sanity,
if Sanity was built in PHP, this is

### segment-135
[148.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=148)
if Sanity was built in PHP, this is

### segment-136
[148.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=148)
if Sanity was built in PHP, this is
Sanity's problem now, not your problem,

### segment-137
[150.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=150)
Sanity's problem now, not your problem,

### segment-138
[150.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=150)
Sanity's problem now, not your problem,
because they have lots of enterprise

### segment-139
[152.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=152)
because they have lots of enterprise

### segment-140
[152.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=152)
because they have lots of enterprise
clients and they need to make sure that

### segment-141
[154.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=154)
clients and they need to make sure that

### segment-142
[154.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=154)
clients and they need to make sure that
they don't tick those guys off that are

### segment-143
[156.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=156)
they don't tick those guys off that are

### segment-144
[156.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=156)
they don't tick those guys off that are
paying hundreds of thousands, millions

### segment-145
[158.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=157)
paying hundreds of thousands, millions

### segment-146
[158.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=158)
paying hundreds of thousands, millions
of dollars. Whereas, you have one IT

### segment-147
[161.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=161)
of dollars. Whereas, you have one IT

### segment-148
[161.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=161)
of dollars. Whereas, you have one IT
team that needs to sort this out. You

### segment-149
[163.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=163)
team that needs to sort this out. You

### segment-150
[163.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=163)
team that needs to sort this out. You
might not even be lucky enough to have

### segment-151
[164.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=164)
might not even be lucky enough to have

### segment-152
[164.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=164)
might not even be lucky enough to have
an IT team. you've got Dave down the

### segment-153
[166.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=166)
an IT team. you've got Dave down the

### segment-154
[166.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=166)
an IT team. you've got Dave down the
hallway that runs WordPress in your

### segment-155
[168.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=168)
hallway that runs WordPress in your

### segment-156
[168.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=168)
hallway that runs WordPress in your
team. So, you've got to be very careful

### segment-157
[170.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=170)
team. So, you've got to be very careful

### segment-158
[170.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=170)
team. So, you've got to be very careful
because when a zero day like this

### segment-159
[172.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=172)
because when a zero day like this

### segment-160
[172.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=172)
because when a zero day like this
happens, that needs to get solved fast.

### segment-161
[175.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=175)
happens, that needs to get solved fast.

### segment-162
[175.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=175)
happens, that needs to get solved fast.
And because there's a smaller surface

### segment-163
[177.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=177)
And because there's a smaller surface

### segment-164
[177.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=177)
And because there's a smaller surface
for headless, there's a lot less chance

### segment-165
[179.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=179)
for headless, there's a lot less chance

### segment-166
[179.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=179)
for headless, there's a lot less chance
of getting hacked, having

### segment-167
[181.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=181)
of getting hacked, having

### segment-168
[181.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=181)
of getting hacked, having
vulnerabilities happen that are as

### segment-169
[183.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=183)
vulnerabilities happen that are as

### segment-170
[183.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=183)
vulnerabilities happen that are as
catastrophic as what's just happened

### segment-171
[184.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=184)
catastrophic as what's just happened

### segment-172
[185.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=184)
catastrophic as what's just happened
here. Whereas the surface of WordPress

### segment-173
[187.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=187)
here. Whereas the surface of WordPress

### segment-174
[187.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=187)
here. Whereas the surface of WordPress
is massive, and this vulnerability is

### segment-175
[190.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=190)
is massive, and this vulnerability is

### segment-176
[190.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=190)
is massive, and this vulnerability is
really, really bad. Those two things

### segment-177
[192.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=192)
really, really bad. Those two things

### segment-178
[192.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=192)
really, really bad. Those two things
work together to be completely

### segment-179
[194.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=194)
work together to be completely

### segment-180
[194.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=194)
work together to be completely
catastrophic. Now, if you're looking at

### segment-181
[197.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=197)
catastrophic. Now, if you're looking at

### segment-182
[197.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=197)
catastrophic. Now, if you're looking at
moving away from this and you're looking

### segment-183
[199.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=199)
moving away from this and you're looking

### segment-184
[199.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=199)
moving away from this and you're looking
at trying to basically build your first

### segment-185
[201.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=201)
at trying to basically build your first

### segment-186
[201.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=201)
at trying to basically build your first
website that is headless, we actually

### segment-187
[203.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=203)
website that is headless, we actually

### segment-188
[203.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=203)
website that is headless, we actually
have a solution just for you. Let me

### segment-189
[206.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=206)
have a solution just for you. Let me

### segment-190
[206.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=206)
have a solution just for you. Let me
show you this. This is our own

### segment-191
[208.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=208)
show you this. This is our own

### segment-192
[208.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=208)
show you this. This is our own
open-source system called TurboArt

### segment-193
[210.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=210)
open-source system called TurboArt

### segment-194
[211.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=210)
open-source system called TurboArt
Sanity. And we basically released this

### segment-195
[213.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=213)
Sanity. And we basically released this

### segment-196
[213.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=213)
Sanity. And we basically released this
in into the open. So, it's got all the

### segment-197
[215.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=215)
in into the open. So, it's got all the

### segment-198
[215.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=215)
in into the open. So, it's got all the
best licenses you could ask for. There's

### segment-199
[217.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=217)
best licenses you could ask for. There's

### segment-200
[217.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=217)
best licenses you could ask for. There's
nothing that we're going to be like a

### segment-201
[218.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=218)
nothing that we're going to be like a

### segment-202
[218.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=218)
nothing that we're going to be like a
clawback clause or any nastiness like

### segment-203
[220.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=220)
clawback clause or any nastiness like

### segment-204
[220.2s](https://www.youtube.com/watch?v=cxACne9TxEM&t=220)
clawback clause or any nastiness like
that. It's full MIT licensing. So you

### segment-205
[222.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=222)
that. It's full MIT licensing. So you

### segment-206
[222.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=222)
that. It's full MIT licensing. So you
can use this for your own business

### segment-207
[224.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=224)
can use this for your own business

### segment-208
[224.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=224)
can use this for your own business
today. But this here is the best Nex.js,

### segment-209
[227.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=227)
today. But this here is the best Nex.js,

### segment-210
[227.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=227)
today. But this here is the best Nex.js,
the best sanity, and the best Versel in

### segment-211
[230.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=230)
the best sanity, and the best Versel in

### segment-212
[230.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=230)
the best sanity, and the best Versel in
our opinion. So the Versell thing, you

### segment-213
[232.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=232)
our opinion. So the Versell thing, you

### segment-214
[232.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=232)
our opinion. So the Versell thing, you
can switch it out to AWS or you can

### segment-215
[233.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=233)
can switch it out to AWS or you can

### segment-216
[233.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=233)
can switch it out to AWS or you can
switch it out to Cloudflare, but why

### segment-217
[235.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=235)
switch it out to Cloudflare, but why

### segment-218
[235.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=235)
switch it out to Cloudflare, but why
would you want to do that? But this

### segment-219
[237.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=237)
would you want to do that? But this

### segment-220
[237.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=237)
would you want to do that? But this
particular system basically makes it

### segment-221
[239.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=239)
particular system basically makes it

### segment-222
[239.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=239)
particular system basically makes it
very easy for you to spin up and

### segment-223
[240.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=240)
very easy for you to spin up and

### segment-224
[240.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=240)
very easy for you to spin up and
basically vibe code your own website.

### segment-225
[243.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=243)
basically vibe code your own website.

### segment-226
[243.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=243)
basically vibe code your own website.
Obviously get us in towards the end and

### segment-227
[244.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=244)
Obviously get us in towards the end and

### segment-228
[244.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=244)
Obviously get us in towards the end and
make sure that you've got it set up

### segment-229
[246.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=246)
make sure that you've got it set up

### segment-230
[246.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=246)
make sure that you've got it set up
properly. But at the end of the day,

### segment-231
[248.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=248)
properly. But at the end of the day,

### segment-232
[248.1s](https://www.youtube.com/watch?v=cxACne9TxEM&t=248)
properly. But at the end of the day,
this is what I would recommend right now

### segment-233
[249.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=249)
this is what I would recommend right now

### segment-234
[249.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=249)
this is what I would recommend right now
because the vulnerabilities shrink to an

### segment-235
[252.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=252)
because the vulnerabilities shrink to an

### segment-236
[252.3s](https://www.youtube.com/watch?v=cxACne9TxEM&t=252)
because the vulnerabilities shrink to an
absolute minute scale versus WordPress

### segment-237
[255.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=255)
absolute minute scale versus WordPress

### segment-238
[255.7s](https://www.youtube.com/watch?v=cxACne9TxEM&t=255)
absolute minute scale versus WordPress
PHP Meltdown and it's extremely fast,

### segment-239
[258.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=258)
PHP Meltdown and it's extremely fast,

### segment-240
[258.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=258)
PHP Meltdown and it's extremely fast,
extremely scalable, and then you can

### segment-241
[260.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=260)
extremely scalable, and then you can

### segment-242
[260.6s](https://www.youtube.com/watch?v=cxACne9TxEM&t=260)
extremely scalable, and then you can
start tacking on what you want as extra

### segment-243
[263.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=263)
start tacking on what you want as extra

### segment-244
[263.9s](https://www.youtube.com/watch?v=cxACne9TxEM&t=263)
start tacking on what you want as extra
features on the website. I hope this was

### segment-245
[266.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=265)
features on the website. I hope this was

### segment-246
[266.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=266)
features on the website. I hope this was
interesting. Tell me how you're getting

### segment-247
[267.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=267)
interesting. Tell me how you're getting

### segment-248
[267.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=267)
interesting. Tell me how you're getting
on at the minute. If anybody's having

### segment-249
[268.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=268)
on at the minute. If anybody's having

### segment-250
[268.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=268)
on at the minute. If anybody's having
any issues with PHP or issues with

### segment-251
[270.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=270)
any issues with PHP or issues with

### segment-252
[270.8s](https://www.youtube.com/watch?v=cxACne9TxEM&t=270)
any issues with PHP or issues with
hosting or all this kind of stuff,

### segment-253
[272.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=272)
hosting or all this kind of stuff,

### segment-254
[272.5s](https://www.youtube.com/watch?v=cxACne9TxEM&t=272)
hosting or all this kind of stuff,
[music] drop us a message below. We'll

### segment-255
[274.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=273)
[music] drop us a message below. We'll

### segment-256
[274.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=274)
[music] drop us a message below. We'll
see if we can help you out. And I hope

### segment-257
[276.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=276)
see if we can help you out. And I hope

### segment-258
[276.4s](https://www.youtube.com/watch?v=cxACne9TxEM&t=276)
see if we can help you out. And I hope
you do well. So enjoy. [music]

### segment-259
[279.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=279)
you do well. So enjoy. [music]

### segment-260
[279.0s](https://www.youtube.com/watch?v=cxACne9TxEM&t=279)
you do well. So enjoy. [music]
Take care. Bye-bye.

## Questions answered on the original page

### How serious is the PHP vulnerability covered in the video?
It is rated 9.2 on the CVSS scale, which goes up to 10, so it is pretty bad. The advice is to update immediately, and if you can't update immediately, you should probably take the entire website offline. We cover this at 0:00 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### Is WordPress safe after PHP2Shell?
Our take is that we would avoid a monolithic, PHP-based system like WordPress, and this vulnerability is the main reason. WordPress has a huge surface area, and a zero day like this needs to be solved fast. In our view, a massive surface plus a vulnerability this bad is a catastrophic combination. We cover this at 0:29 and 2:49 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### Why do we call WordPress a monolith?
WordPress handles a lot of different systems in one place: logins, plugins, forms that a lot of people keep in there, and quite extensive user management. All of that runs inside one monolithic system, which is what gives it such a large surface area. We cover this at 0:58 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### What is a headless website and why is it more secure?
A headless system is usually a website built with a framework like Next.js, which is what we build, or React Router or Astro. It sits on a very narrow surface area compared to WordPress. Because the surface is smaller, there is a lot less chance of getting hacked or of a vulnerability as catastrophic as this one. We cover this at 1:17 and 2:55 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### Can I choose my own backend, forms and user management with headless?
Yes. With headless you pick whatever you want as a backend, whatever you want for forms, and a service like Clerk for user management. You pick the best option in the industry for each job and bolt it on. We cover this at 1:39 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### Why would a hosted CMS like Sanity be safer than WordPress?
With a CMS like Sanity or Contentful, the vendor has to manage the security, so a vulnerability is their problem, not yours. Sanity has enterprise clients paying hundreds of thousands to millions of dollars, so it has to keep them happy. With WordPress, the fix falls on your one IT team, or on whoever runs WordPress in your team if you don't have one. We cover this at 2:17 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take

### What is Turbo Start Sanity?
Turbo Start Sanity is our open source starter for building a headless website with Next.js, Sanity and Vercel. It is fully MIT licensed with no clawback clause, so you can use it for your own business, and you can swap Vercel for AWS or Cloudflare. It makes it easy to spin up and vibe code your own site, though we recommend getting us in towards the end to check it is set up properly. We cover this at 3:26 in the video.
Source: https://robotostudio.com/videos/is-wordpress-safe-after-php2shell-our-take