Sarcio

Build and change your WordPress site by asking in plain words. Preview it, approve it, undo it anytime. When something breaks, Sarcio drafts the fix.

[Sarcio @sarcioai]

Meet Sarcio: build and change your WordPress site by asking in plain words. You see the change on a preview of your real site, then apply it. Every change can be undone.

13 seconds, real recording: new opening hours, previewed and live.

[Sarcio @sarcioai]

@catmanyau @batuhan @jetpack Done. Shipped tonight in 0.16.1: the preview bar now has a Show live button. Flip any page between your changes and what everyone else sees, as often as you like, without applying or losing anything. Thanks for the nudge.

[Sarcio @sarcioai]

@catmanyau @batuhan @jetpack Today it's the staged version laid over your real site, visible only in your browser, so a private window or anyone else still sees what's live. A one-click flip between the two is a good call though, especially for spotting layout shifts. Noting it.

[Sarcio @sarcioai]

@DrAi404 @Pirat_Nation Finally, readers who make it past the homepage. Shame they only ever ask for the database password and never leave a comment.

[Sarcio @sarcioai]

We went with the real page over a diff: the change lands on a private preview of your own site that you click around in, and each step the assistant takes comes with a one-line "why". Owners judge by looking, not by reading fields. A field diff is great for developers though, and worth offering as a second view.

[Sarcio @sarcioai]

@LiveOverflow @0x4D31 The scanners checked the last post date, saw 2023 and assumed the server had already been abandoned to someone else. Most underrated security control of the year: a blog nobody, including the attackers, believes is still alive.

[Sarcio @sarcioai]

@Nonosam2 The three stages of a site going down this week: 1. it's PHP2Shell, 2. it's the host, 3. it's the thing I changed at 11pm. Glad you skipped straight to 3 and it was quick.

[Sarcio @sarcioai]

What usually gets a site back fastest after a copyright complaint: reply on the abuse ticket (not the support one) saying the specific URLs in the complaint have been removed. Hosts often block the whole account until that confirmation lands. If you think the complaint is wrong, ask them for the counter-notice process instead.

[Sarcio @sarcioai]

@stepru @GoDaddyHelp Following up on how to know: we wrote the whole check up step by step, in plain words, including what to ask GoDaddy and how to read the build date, since their patched PHP keeps the old version number. https://t.co/2SgjEI2dRt

[Sarcio @sarcioai]

@djbobbydrake @GoDaddyHelp @GoDaddy Since a few people on GoDaddy cPanel hit the same wall, we put the steps in one place, including where GoDaddy moved the PHP setting (it's in your account now, not cPanel) and how to read the build date: https://t.co/pmoaQ9sj0Q

[Sarcio @sarcioai]

Sorry, that's rotten luck. Sounds like you're in good hands. For when it's back: patched PHP stops new break-ins but doesn't remove what got in, so a restore from before the hack plus new passwords everywhere (site admin, hosting, database) is what makes it stick. Worth a quick look for admin users you don't recognise too.

[Sarcio @sarcioai]

@drwesterfield @willardhoppe @GoDaddyHelp @djbobbydrake If it helps getting the site back up, the steps for reading the build date are written out here, including the GoDaddy details (the PHP setting moved out of cPanel into your account). https://t.co/izoqoikJ1P

[Sarcio @sarcioai]

@joshuavandercar @bluehost @frosterxpalt @ThePHPF You asked for a page, so we wrote one: the fixed versions, how to confirm the fix with the build date, and what owners found at Bluehost (PHP is set in two places that can disagree). https://t.co/2SgjEI2dRt

[Sarcio @sarcioai]

The guide: version numbers, where WordPress shows yours, what owners found at GoDaddy, Bluehost and cPanel hosts, and the one question to ask your host. https://t.co/2SgjEI1G1V

[Sarcio @sarcioai]

Is your WordPress site patched for the PHP fix? The version number might not tell you.

Many hosts put the October 21 fix into the PHP they already run without changing the number. GoDaddy customers are seeing 8.4.26 with a build dated 10/21.

The build date is the proof. We wrote up how to check it, host by host, in plain words.

[Sarcio @sarcioai]

From building an AI assistant inside WordPress: connecting the agent turned out to be the easy part. The hard part is what happens between "the agent wants to change this" and "it's live". Site owners trusted it once they could see a preview first, approve it, and undo it afterwards. Hoping core gets that layer as well as the plumbing.

[Sarcio @sarcioai]

One small mercy: if the host is patching in place (same version number, new build date), nothing changes for the plugins and nothing breaks. It's only the clients stuck on 8.1 or older that need a real version jump. Do those on a staging copy first. Steaming dung is best handled with gloves.

[Sarcio @sarcioai]

Until they post one, here's how to confirm it yourself. A version of 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or higher is covered. If yours is lower, hosts often patch without changing the number, so check the Build Date in phpinfo: Oct 21, 2026 or later means the fix is in. Anything on 8.1 or older gets no fix and needs moving up.

[Sarcio @sarcioai]

If it's your site's email that's bouncing, you can get around the shared IP instead of waiting on them. Send the site's mail through a proper sender (on WordPress, a mail plugin connected to Gmail/Google Workspace, Brevo or similar), so it never leaves from the blacklisted server address. Then it stops mattering who else is on that IP.

[Sarcio @sarcioai]

Worth checking before you chase 8.5.12: GoDaddy has been putting the fix into the versions it already runs without changing the number. Look at the Build Date in phpinfo. Another customer found 10/21/2026 on a version that still read 8.4.26. If the date is the 21st or later, you're covered on either version.

[Sarcio @sarcioai]

You may be able to bring it back already. GoDaddy has been installing the fix without changing the version number: one customer here checked phpinfo and the Build Date read 10/21/2026, the day the fix came out. If yours shows that date or later, you're patched even though it still says 8.4.26.