Migrate WordPress to Wix Headless with Claude Code

Signal & Noise — things I found today which caught my interest Every agent demo dies on the second question, when it re-reads everything like a student who lost their notes. https://lnkd.in/ehpC9_7Q Upgrading PHP is the easy part. After that you get to find out which of the forty keys in the drawer still open anything. One of them fits a shed. Nobody remembers where the shed is. https://lnkd.in/ewcMqZ4w Code does exactly what you think, which is the problem. It faithfully executes the muddle in your head and calls it a feature. Writing is where you find out your thinking never compiled in the first place. https://lnkd.in/eugD9nA7 Bluetooth isn't short range... all you need is to bolt a dish antenna on, tune the receiver to hear a whisper, and you can get to over 7 miles! https://lnkd.in/egj6z7zF Does a website hosting mainly static content need runtime? Andrew with a write up on his personal journey with wordpress and php https://lnkd.in/epYk7c_U Agents.md in downloads is apparently all it takes to turn you AI rogue. https://lnkd.in/ekW_xn_H

Great news if you always wanted your WordPress site to have more admins. PHP2Shell (CVE-2026-109618, CVE-2026-109619): a multipart request makes PHP run out of memory mid-parse, and the error skips cleanup. That same request carries bytes PHP then misreads as a live object, giving remote code execution before your app code even runs.

PHP2Shell landed on October 21: two pre-auth RCEs, rated 9.2 by the PHP project, fixed in 8.2 through 8.5. If you're still on 8.1 or older, there's no release for you. The PHP security team published source backports for 7.4, 8.0 and 8.1. Heroku rebuilt 8.1.34 with the fix and labeled it "a minimal mitigation, not a supported release". Precursor Security estimates roughly 18% of WordPress sites and 24% of Joomla sites run 8.1 or older. And 8.2, patched this week, reaches end of life on December 31. An EOL runtime is a bet that someone upstream will backport for you when it matters. This week, some did. Next time, maybe not. Bumping the version is rarely what slows a team down. Proving the app still behaves the same is, which is why the migration plan I'd defend starts with the test harness, not the Dockerfile. At Qovery that's how we approach it: write the change, verify it on an ephemeral copy of production, then merge. What's the oldest runtime still serving traffic in your stack?

Real Problems I Solved — Part 1/10 🚨 A 504 Gateway Timeout doesn't always mean the server is down. A website can be running, yet a request can still fail because the server takes too long to respond. Here's how I approach this type of issue. 🔴 The Problem A WordPress website returns a 504 Gateway Timeout error when processing a request. 🔍 The Investigation Instead of immediately increasing the server timeout, I would investigate: PHP error logs Web server logs PHP execution time Database query performance Slow plugins or external API requests Server resource usage The goal is to identify where the request is getting stuck. 🛠️ The Solution The correct fix depends on the root cause. It could involve optimizing a slow query, improving PHP logic, resolving a plugin issue, or adjusting server configuration when appropriate. 📚 The Learning Increasing the timeout may hide the symptom without fixing the underlying problem. Debug the root cause before applying a workaround. As a backend developer, I believe understanding why something fails is just as important as knowing how to fix it. #PHP #WordPress #BackendDevelopment #Debugging #WebDevelopment

So if you have seen the news this week about websites being taken offline because of a “critical PHP flaw”... here’s the plain English version 👇 PHP is the code that runs behind about 70% of websites, including every WordPress site. Two serious security holes were found in it (by AI, funnily enough) and a fix came out on Wednesday afternoon. It was serious enough that the Finnish government, Edinburgh council and even bits of the BBC took their sites offline. The good news? If I host your website, you are sorted. My hosting provider 20i had every server patched by 9pm the same day. I have also been through client sites this morning checking for anything dodgy. ✅ And a little bit of smugness... I’ve been building new sites on PHP 8.3 for well over a year now, and earlier this year I moved all my older sites over to get ahead of PHP 8.2 being retired in December. So none of my clients were stuck on an old version when this landed. If someone else looks after your website, or you are honestly not sure who does (no judgement, it happens more than you’d think!)... it’s worth asking them 3 quick questions: 1️⃣ Is my site on a patched version of PHP? 2️⃣ Is it running PHP 8.3 or newer? 3️⃣ Has anyone checked it for signs of a break-in? If you get blank looks, drop me a message and I’ll take a look for you. No hard sell, I promise. I just don’t like the idea of good businesses getting caught out by stuff like this. #WordPress #WebsiteSecurity #SmallBusiness #Cheshire #WebDesign

On October 21, a lot of websites went offline while their owners rushed to install emergency security fixes. Two serious flaws had been found in PHP, the programming language behind a huge share of the web, including WordPress sites. Government websites in Europe and Canada, and some of Wikipedia’s systems, went offline as a precaution. Here’s the part many owners miss: updating WordPress is not the same as updating PHP. Automatic updates won’t install this fix. Someone has to update the technology the site runs on, and many owners aren’t sure who that is. Three questions to ask your web host or developer: 1. Who updates the technology my site runs on (like PHP), not just the plugins? 2. How would I find out if something went wrong with my site? 3. Is the fix installed, or only scheduled? If you don’t know who to ask, that’s the first thing to find out. I build sites on Wagtail, which runs on Python, so this flaw doesn’t apply to them. No technology is immune to problems, though. What matters is that one named person or company is responsible for keeping your site updated. If a security fix came out tonight, do you know who would install it on your site?

𝗔𝗜 𝗷𝘂𝘀𝘁 𝗳𝗼𝘂𝗻𝗱 𝗮 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗵𝗼𝗹𝗲 𝘁𝗵𝗮𝘁 𝘀𝗮𝘁 𝗵𝗶𝗱𝗱𝗲𝗻 𝗳𝗼𝗿 𝗼𝘃𝗲𝗿 𝟭𝟬 𝘆𝗲𝗮𝗿𝘀 𝗶𝗻 𝗣𝗛𝗣, 𝘁𝗵𝗲 𝗰𝗼𝗱𝗲 𝗯𝗲𝗵𝗶𝗻𝗱 𝗪𝗼𝗿𝗱𝗣𝗿𝗲𝘀𝘀, 𝗠𝗮𝗴𝗲𝗻𝘁𝗼 𝗮𝗻𝗱 𝗺𝗶𝗹𝗹𝗶𝗼𝗻𝘀 𝗼𝗳 𝘄𝗲𝗯𝘀𝗶𝘁𝗲𝘀. If your website or app runs on PHP, this one is about you, even if you've never written a line of PHP yourself. Here's what happened last week 👇 👉 On 21 October, PHP released urgent fixes for two critical security flaws found with the help of AI. Security agencies in the UK, US, EU and Australia told organisations to update fast, or take their sites offline until they could. 📊 Source: BBC News, 21 October 2026 𝗪𝗵𝗮𝘁 𝗶𝘁 𝗺𝗲𝗮𝗻𝘀 𝗳𝗼𝗿 𝘆𝗼𝘂: 1️⃣ Ask your developer or hosting provider one simple question today: "Do we run PHP anywhere, and is it updated?" It can be hiding inside WordPress, plugins or hosting panels. 2️⃣ Every PHP version needs the update, not just old ones. If you're on PHP 8.1 or older, there's no fix for your version, so you'll need to upgrade. 3️⃣ After any update, test your key flows again: login, forms, checkout. A security fix that breaks your checkout is a new problem. 💡 AI is finding bugs faster than ever. The question is whether you find yours first. Have you checked whether your website runs on PHP yet? #SoftwareTesting #QA #AIcoding

The last 72 hours have been absolutely insane, and then I just found a bug that puts 70% of the world's websites at risk. It's called PHP2Shell. PHP runs most WordPress sites, online shops and booking sites, and this bug lets a stranger take over the server without logging in. → Tue: the details leaked early. → Wed: PHP shipped a fix. Attackers started trying it 19 minutes later. → Thu: exploit code showed up on GitHub. Here is how you can be saved. 1. Updating WordPress won't fix it. The bug sits in PHP, underneath your site. 2. Find "PHP version" in your hosting panel. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35. 3. On shared hosting? Ask your host today: "Am I on the patched PHP, and did you restart it?" Send this to whoever runs your website.

When did anyone last change the setup behind your website? If your WordPress site was built a few years ago and has run quietly since, it may still be on an old version of PHP, the software your site runs on behind the scenes. PHP 8.1 and older no longer get fixes from the PHP project. On those versions, protection from the October 21 bugs has to come through your host, the company you pay to keep your website online. You don't need to guess. Ask your host two things: which PHP version your site is on, and whether they've covered it. The full checklist, the host messages and live updates: https://lnkd.in/esv9yvrt

A couple of weeks back: The hilarity of being chased about a PHP bug that affects our blog platform when we built it to static push content out of an internally hosted WordPress to GH pages when we hit publish. Not sure the detection being used by the ASM tool is entirely accurate. This week: Rerun with respect to the latest PHP bug. Our operations had marked it FP before I got there. That's a team that's always looking to improve. 😍 It was a good design 15 years or so ago when we made it and it's still a good design now. It's paid forwards somewhat :)