How to Not Get Hacked 101

Black October: two critical PHP flaws found by AI took government sites offline and exposed API keys at hosting platforms. Here's what happened, what to do whether you use or build websites, and a free skill that audits your own app for the 15 most common ways apps get hacked.

Claude just became your whole creative team

Anthropic dropped a bunch of new stuff in the last few weeks.

1. Live dashboards

You connect your data (BigQuery, Snowflake, Databricks, Salesforce and more), and Claude builds a dashboard that updates itself. You can share it with your team by sharing a link.

2. Motion

It's not an AI video generator. Claude writes code that animates your text, charts, and images, then you export it as an MP4. Think animated explainers and charts that move, not realistic footage or AI people.

3. Docs, Slides, and Design are out of beta

They're now on every plan, including Free. Docs is for reports and memos, Slides for full decks, and Design for posters, landing pages, and app screens. Over 45 million of these have already been made in Claude, and I've been using Design since August to brainstorm app layouts.

Design has its own separate website right now, but it's moving inside Claude on December 14, so move your design systems over if you already use it.

---

AI hacked the internet

I usually keep these fun, but this one's too important to joke through. Everyone who builds or uses anything online needs to know what happened over the last few days.

What happened

Two critical security flaws were found in PHP by AI models. PHP is a programming language that runs a huge chunk of the web, nearly 70% of all websites. Those flaws can give an attacker control of a site's server and, most importantly, user data.

Government sites in Canada, the UK, the Netherlands, Finland, France, and many more pulled sites offline on October 21st to patch. Railway, a leading platform for hosting apps, got breached the same day, exposing API keys and user logins. People are calling it the biggest cybersecurity attack of the modern era and dubbed it "Black October".

Read more in The Guardian

Why it matters

• If a website you use runs PHP, your info could be exposed.
• If you build websites or apps, your customers' info could be exposed.
• API keys were leaked from several developer platforms.

Most concerning, this isn't a single AI swarm behind all of it. It's a pattern that's becoming more common: AI finds bugs faster than people can patch them.

What to do (as a user)

1. Delete accounts you don't use. Each one is a place that can get breached.
2. Use a password vault like 1Password.
3. Use an authenticator app or a hardware key for 2FA. Drop the SMS.
4. Make a family code word. AI scam calls and texts are getting good, and a code word shows it's really them.

What to do (if you build stuff)

1. Update PHP, WordPress, and plugins today.
2. Rotate all your API keys on a set interval.
3. If you deploy on Railway, rotate your environment variables immediately.
4. Collect less data from users. You can't leak what you never stored.
5. Use "Sign in with Google" instead of storing passwords yourself.

---

Builder's notes: app-lockdown, a free skill that audits your app

After all that, you're probably wondering if your own app is safe. I did too, so I built a free skill that checks. It's called app-lockdown:

app-lockdown on GitHub

It audits your app for the 15 most common ways apps get hacked. The problem is that people build with AI and think telling it "make my app secure" will do the job, and all it does is move your API key into a .env file and call it a day. (For the legal side of vibecoded security, see How to Not Get Sued 101.)

Here's what app-lockdown does:

1. Scans your project.
2. Writes a plain-English report ranked Critical to Low, with the exact file and line.
3. Fixes each issue one diff at a time, and nothing changes until you approve it.
4. Re-scans to make sure the fixes held.

A few of the 15 checks:

• Exposed API keys
• Missing authentication
• Changing an ID in the URL to read someone else's data
• Open Supabase and Firebase databases
• Fake "payment succeeded" webhooks
• No rate limiting
• Fake packages an AI hallucinated

It works on any stack, and it's sharpest on JS/TS, Python, and, you guessed it, PHP.

How to use it

1. In Claude Code, run git clone https://github.com/markpyvo/app-lockdown ~/.claude/skills/app-lockdown.
2. Open Claude in your project and say "Run app-lockdown on this project".
3. On the Claude app, download the ZIP from GitHub and upload it as a custom skill.

Disclaimer: this is just one part of the code review you should already be doing to secure your app, not a run-it-once-and-forget-about-security solution.