In partnership with
Hi tech & AI enthusiasts, this week's highlights:
A Leaked PHP Bug Put Millions of Websites at Risk
Anthropic Launches an Agent That Works While You're Away
ChatGPT Can Now Work Inside Your Chrome Tabs
The Lab: Audit Your Website's Security in 30 Minutes With AI
AI Image of the Week: A construction site hoarding with a security twist
Let's get into it.
▲ WEB SECURITY
PHP runs a huge share of the web, including every WordPress site. Last week details of two critical flaws, now called PHP2Shell, leaked a day before they were due to be announced. PHP rushed out emergency fixes on 21 October. Government sites went offline and the US NSA told organisations to "immediately update or take their systems offline."
What you need to know
No password needed: Attackers can take control of an unpatched server without logging in.
Know your number: The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older in those lines is exposed.
Old PHP is stuck: PHP 8.1 and older are no longer supported, so there's no normal update. You need to upgrade, or get your host to confirm in writing they've patched it.
Already in use: Amazon caught an attack attempt four days before the bug was made public.
A free stopgap: Sites behind Cloudflare get free protection rules for the known attacks, on every plan.
Key Idea
▲ Why it matters: Most businesses have no idea which PHP version their site runs. It was the first thing I found when I started with a fit-out company last year. Old PHP meant they couldn't update their plugins, bots were hitting the site and the forms had stopped sending. Fixing it meant moving hosting. If you don't know your version, find out this week. The Lab below takes 30 minutes.
▲ AI AGENTS
Anthropic just opened a research preview of Claude Duet, a new app where Claude stops waiting for you to open a chat. You hand it work by message. It keeps going when you step away and comes back when something's done or needs a decision.
What you need to know
It comes to you: Duet flags what needs your attention instead of you checking in on it.
It asks first: It checks with you before sending a message, making a payment, signing a document or deleting anything.
Built for busy owners: Anthropic pitches it at professionals and small business owners with more on their plate than they can track.
Waitlist only for now: US Pro and Max subscribers can join. Team and Enterprise plans aren't included yet.
It eats your allowance: There's no extra price, but background work counts against your plan's usage limits, so you'll hit them sooner.
Key Idea
▲ Why it matters: This is the shift from "AI you talk to" to "AI that works for you." Think follow-ups chased, inboxes triaged and small tasks closed while you're on site or in meetings. Join the waitlist now and decide what you'd hand it first. Keep anything sensitive on approval mode until you trust it.
▲ AI ASSISTANTS
OpenAI just turned ChatGPT's Chrome extension into a full browser assistant. Tag Chrome in ChatGPT and it can read the tabs you have open. Switch to Work mode and it can do things in them for you.
What you need to know
It reads what you're looking at: Compare three suppliers' pricing pages, summarise a long article or check facts across tabs without copying and pasting.
It can take action: In Work mode it fills in forms, sends messages, downloads files and tidies your tabs into groups.
It works where you're logged in: That includes sites like Gmail, LinkedIn and Salesforce, and it runs in the background while you keep browsing.
The browser is gone: OpenAI shut down its standalone browser, so the extension is now the main way ChatGPT gets into your browser.
Key Idea
▲ Why it matters: The boring browser jobs, like comparing quotes, filling the same supplier forms or pulling numbers into a sheet, can now be handed off. But anything that can act in your logged-in Gmail can also make mistakes in it. Start with read-only comparisons, check what it does before you approve, and keep Work mode away from banking and payments. Check your ChatGPT plan to see which mode you get.
▲ EVEN MORE NEWS
Other big ideas from the past week.
▲ 1Password Lets AI Agents Log In Without Seeing Your Password: Your agent asks, you approve on your phone and 1Password fills in the login. The agent never sees the password. It's a sensible fix for handing agents your accounts. Waitlist now.
▲ Ideogram Can Now Make Editable Vector Graphics: Ideogram's first vector model turns a text prompt, or any image, into a clean SVG you can edit in Illustrator, Figma or code. Handy for icons, logos and graphics that need to stay sharp at any size. Live in Ideogram and its API.
▲ Skyfall Unveils an AI Built for 3D Engineering Design: SKY-001 turns a prompt or sketch into a plan for building parts and structures in CAD. By the company's own tests it's about 51 times faster than the leading general models for the same accuracy. It's still a research preview, and floor plans are its weak spot for now.
The Lab
▲ AI EDUCATION
This week you'll check your own website the way I check a client's on day one.
Find your PHP version, run your plugin list past AI for known problems, check your free protection and get a ready-to-send email for your host or web agency.
What you'll learn:
How to find your PHP and WordPress versions in two minutes
The prompt that checks your plugins against this month's attacks
How to check Cloudflare's free protection for PHP2Shell
What to ask your host, written for you by AI
How to turn it into a weekly check you don't have to remember
🔬 Interested in learning about AI for business? Join The Lab waitlist.
▲ AI IMAGE SHOWCASE
A Construction Site Hoarding With a Security Twist
This week's image matches the security theme: a site hoarding that reads like a security message, made for construction and property brands.
Prompt:
A photorealistic street-level photo of a modern construction site hoarding in a UK city at dusk. The navy hoarding panels carry a clean graphic of a large padlock made from scaffolding poles merged with a website browser window, and the words "Secure by design" in bold white sans-serif type. Warm streetlights, wet pavement reflections, a person in a hi-vis jacket walking past with slight motion blur. Shot on a 35mm lens, shallow depth of field, editorial photography style. No logos or brand names.Tool: ChatGPT Images 2
Image Usage Suggestion: Security awareness posts, website relaunch announcements, blog headers on cyber security, hoarding and signage mock-ups, construction and property social content, tender and bid document covers.
💌 Reply to this email with your own version and I'll feature it in a future newsletter.
▲ SHARE YOUR THOUGHTS
Help shape the content you see here by giving feedback
Have specific feedback or want to get in touch? Reply to this email and I’ll get back to you.
Know someone who'd love this newsletter? Forward it to a friend and have them sign up here.
Thanks for reading, until next time.
Stay curious,
Matt Lok, Editor
Brought to you by Metalabs. Websites and marketing that win work for fit-out and construction firms. Carousels made with SlideDrift.