Do this: Ask your web host one question in writing: which version of PHP does my site run, and when is it patched? Two minutes. 'We handle that' is not an answer.
PASTE THIS
Write a short ticket to my web host, under 90 words, plain English. Say: I am the account holder for [domain]. Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were patched today. Please confirm in writing the exact PHP version my site runs, whether it is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, and if not, the date it will be. Ask whether updates are automatic on my plan. Request a reply today.
You'll get: A send-ready ticket and four written facts you can hold the host to. Send it before you close today; a patch that lands next Tuesday is a different risk from one that lands tonight.
Five checks to run the hour after your site is patched
A patch is not a working site. Once your host applies it, open a private window and run these in order.
Then write one line in your notes: the date, the version the host reported, and who confirmed it. If a step fails, the patch broke something, and finding out on Monday costs a weekend of orders.
Wiz says a single researcher with frontier models built this exploit in a week, work a specialist team would have needed months to do. That cuts both ways. The defender's window is now the same size as the attacker's: patch day, not patch month. Most small sites will hear about it from a host's status page, usually days late.
PHP powers 70% of the world's websites. The flaws sit in PHP itself, not the app: an unauthenticated attacker can run code or read passwords and keys from memory, Wiz Research reports. Versions back to 5.4 are affected.
Patches shipped today: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (The Register, release notes). Cloudflare and AWS pushed temporary blocks; break-in attempts are already logged.
So what: this week, get your host to name your PHP version and patch date in writing. If it will not, take the site offline.
Half your managers cannot grade the work anymore
A Nielsen survey of 1,700 directors and senior managers across seven countries found more than half say AI made it harder to judge their team's output, TechCrunch reports. 78 percent changed how they evaluate people, and 39 percent use AI to draft performance reviews. So what: this week, rewrite one role's scoreboard around output delivered, not activity logged, before the next review cycle opens.
A regulator is reading the listings on Booking.com
The European Commission opened a formal probe into Booking.com over fake listings and phishing, after more than 1,000 fraud reports in the Netherlands alone in early 2026, a tenfold jump on the year before, The Register reports. So what: if a marketplace brings you customers, this week export a direct contact list you own, because tighter checks will hide unverified sellers and hold payouts first.
Every AI chat you shared has a findable address
Researchers enumerated 6,800 share links from Meta's Muse and opened hundreds that held material nobody meant to publish, including an executive-search brief and a loan application draft, Ars Technica reports. Meta paused link sharing while it reviews the design, The Verge reports. So what: this week, search your sent mail for cf.metaaiusercontent.com, delete any link you find, and re-send the content as plain text.
This week's question: the host says updates are automatic, so is there anything left to do? Yes, twice. Automatic usually means a maintenance window, and this patch shipped today, so the window may be days away. Ask for the version number and the date in writing. Then ask who is told if that window slips. If the answer is a status page, put a reminder in your calendar to check it tomorrow morning. A host patching on its own schedule is fine until the day the exploit is public, and today it is.
Do you know which version of PHP your website runs?
A. Checked today and it is patched
B. Know the host, not the version
C. No idea
D. No website here
Reply with one letter — results next issue.
Meta's Muse hit 10 million US downloads in 40 days. Only how many other apps have done that?
Answer tomorrow — and no, we are not printing it here.
YESTERDAY'S ANSWER
Google's London cloud region fell over for hours this week, taking UK banks with it. Which single zone failed?
europe-west2-b, one of three zones in Google's London region (The Register, 20 October).
About 5 minutes to read. One thing you can use today every issue.
Every Friday the desk answers one reader's AI question in depth. Reply with yours — the best one gets the full writeup.
Know an owner drowning in their inbox? Forward this — the 2-Minute Win is worth 2 minutes.
Forwarded this? Subscribe here
Sent by AI for Everyday Business.
8735 Dunwoody Place STE R, Atlanta, GA 30350