In partnership with
A Single Typo Shouldn’t Cost You a Sale
A shopper types “running shos” and gets nothing back. Another types “red waterprof trail runners under $150” and hits the same wall. Both knew what they wanted.
Traditional site search relies on exact keyword matching, leaving shoppers stranded at “0 results found” screens.
Gladly understands what shoppers mean, typos and all. Instead of a dead end, they get products that fit what they asked for and a conversation that keeps them shopping.
Beginners in AI
Good morning and thank you for joining us again!
If you have a website, there's a good chance it runs on PHP, the code behind about 70% of the web. Yesterday the NSA warned about two serious holes in it, and AI tools found them before criminals did. Today I'll explain what that means for your site and the one question to ask your web host. As always, every story here is human picked and edited.
THE FRONT PAGE
AI Found Two Critical Holes in PHP, the Code Behind 70% of Websites
TLDR: AI tools used by an OpenAI partner and by Google's Wiz found two critical flaws in PHP that go back to 2004, and the fixes are out now.
The Story:
PHP is the programming language running behind roughly 70% of websites, WordPress sites included. On Wednesday the NSA warned that two critical flaws in it could let attackers reach a site's files or its database. Its advice was blunt: any site that can't be patched right away should go offline until it can. The holes exist in every PHP version since version 5, released in 2004.
AI found them. Security firm Calif used OpenAI's GPT-5.6 Sol, through OpenAI's Patch the Planet program, to spot one. Google's Wiz used its own Wiz Atlas agent along with Gemini 4 Argon and GPT-5.6 Sol to find more. Both teams worked with PHP's maintainers on the fixes before going public, and OpenAI says nobody has seen the flaws used in an attack.
Its Significance:
These bugs sat unnoticed for over 20 years, and AI caught them before criminals did. Wiz added a warning, though: the same AI makes the holes far easier to exploit, so the window to patch is short. If your site runs on WordPress or another PHP tool, ask your host today whether you're on PHP 8.5.12, the recommended version. Versions 8.1 and older no longer get fixes and need an upgrade. OpenAI expects more finds like this in the coming months, so "update when asked" is about to matter a lot more.
QUICK TAKES
The story: iPhone drivers using Google Maps on Apple CarPlay can tap the Gemini icon and ask for lunch along the route, a gas station or a toll-free detour, or report a crash. It's live in the US now, and Google says a wider rollout is under way.
Your takeaway: Asking out loud beats poking at a screen at 60 mph. Android Auto drivers have had Gemini since last year, with some rough patches, so expect a few misheard requests at first.
The story: Walmart's new Agent Gateway lets approved AI assistants, including ChatGPT, Gemini and Meta's Muse, search Walmart and Sam's Club and buy things for you. Starting next month, each agent gets its own profile in your account, where you can approve every purchase or set a spending limit.
Your takeaway: It works with any Walmart account, no Walmart+ needed. Walmart says agents never see your payment details, and its normal returns process applies when an agent buys the wrong thing.
The story: Duet connects to apps like Gmail, Slack and QuickBooks, sends a morning brief, checks in every few hours and works on tasks in the background on its own cloud computer. It's a research preview for US Pro and Max subscribers, by waitlist, on the web and iOS.
Your takeaway: Anthropic says Duet asks before it sends messages, pays, signs or deletes anything, and admits it can misjudge what's urgent. It goes up against Meta's Muse and OpenAI's Dots, and its background checks count against your plan's usage limits.
TOOLS ON OUR RADAR
🛡️ Wordfence Free: Adds a firewall and malware scan to WordPress sites, though it won't update PHP for you.
🎬 VLC Free and Open Source: Plays almost any video or audio file on your computer or phone, with no ads or tracking.
🧘 Stretchly Free and Open Source: Nudges you to take short screen breaks through the day, a free swap for paid break timers.
🧹 BleachBit Free and Open Source: Clears junk files and browser leftovers on Windows or Linux, like CCleaner without the upsells.
✅ Todoist Freemium: Keeps your to-do list on every device, with reminders and due dates free for up to 5 projects.
⚙️ Make Freemium: Connects your apps so repetitive busywork runs on its own, with 1,000 free credits a month.
📬 beehiiv Freemium: Start your own email newsletter free for up to 2,500 subscribers, on the platform this one uses.
TRENDING
Recursive Released Flint, a Free Coding Model That Runs on a Laptop. The startup says its own AI research system did much of the work of building it in under four months. It's free to download and works offline, but Recursive says it needs more step-by-step guidance than paid coding assistants.
Meta Says Muse Passed 10 Million Users, and Shopping Is a Top Use. About 25% of people who set it up use it daily, Mark Zuckerberg said on Meta's earnings call. Meta plans to keep it free for most people and take a cut of what you buy through it.
OpenAI's Agents Combed Through Millions of Brain Cells in 32 Minutes. Working with PerturbAI and Scripps Research, thousands of GPT-Rosalind agents each studied one gene change in a mouse brain atlas, work the team says would take people months to a year. The leads still need lab tests, and the paper isn't peer-reviewed yet.
ChatGPT Ads Now Run in 89 Countries. OpenAI says more than 100,000 advertisers have bought ads in a little over eight months. Ads only show on the Free and Go plans, while Plus and Pro stay ad-free.
ChatGPT Now Lets You Lock Chats Behind a PIN or Face ID. Locked chats move to their own section, out of sight of anyone who borrows your phone. It doesn't add encryption, and resetting your PIN deletes those chats for good.
Managers Say AI Made Their Teams' Work Harder to Judge. In a Nielsen survey of 1,700 senior managers for Monday.com, over half said evaluating work got harder. And 58% expect to oversee more AI agents than people within a year.
TRY THIS PROMPT (copy and paste into Claude, Grok, ChatGPT, or Gemini)
🛟 Ask My Host: find out if this week's PHP fix needs anything from you
Build a single-file HTML app called Ask My Host in vanilla HTML, CSS and JavaScript. No API key needed.
I pick what my website runs on (WordPress, Squarespace, Wix, Shopify, custom or not sure) and type my web host's name. The app calls the Anthropic Messages API with the web_search tool to check the latest advisories on this week's critical PHP flaws and anything my host has said publicly.
It must never invent versions, dates or host statements. If it can't find something, it says so.
Show a verdict card (act now, likely handled, or unknown), 3 to 5 plain steps, what my host has said, a ready-to-send message asking my host which PHP version I'm on and whether it's patched with a copy button, and source links.
Style: near-black background, teal and amber accents, Bricolage Grotesque, Literata and JetBrains Mono fonts.What this does: Pick what your website runs on and type your web host's name. The app looks up the latest advisories and anything your host has said about this week's PHP flaws, then tells you to act now, that it's likely handled, or that it can't tell. You also get a few plain steps and a ready-to-send message asking your host which PHP version you're on. If it can't find something, it says so instead of guessing.
Turn your expertise into working software
Describe what you want to build
Get real software, not a prototype
Lovable handles payments, logins, databases
Change any detail yourself, any time
Put it in front of customers this week
Discount of $5 applies to first month of any paid plan. You need to sign up via this webpage in order to claim the discount. The discount applies to new and returning users without an active paid plan. Terms apply.
WHERE WE STAND(based on today’s news)
✅ AI Can Now: Dig through decades-old code and find serious security holes people missed for over 20 years, as GPT-5.6 Sol and Gemini 4 Argon did with PHP.
❌ Still Can't: Patch the web by itself. Every host or site owner still has to install the fix, and the same AI makes the holes easier to attack in the meantime.
✅ AI Can Now: Answer spoken questions while you drive, like finding lunch along your route in Google Maps on CarPlay.
❌ Still Can't: Always hear you right over road noise. Gemini on Android Auto has had rough patches, and the CarPlay version is brand new.
FROM THE WEB
RECOMMENDED LISTENING/READING/WATCHING
🎬 Zero Days (2016) - Movie
Alex Gibney's documentary tells the story of Stuxnet, the computer worm the film says the US and Israel used to damage equipment at an Iranian nuclear site, and how it spread far past its target. It's a gripping look at what one hidden software flaw can do in the wrong hands. Watch it and today's lead stops feeling abstract: finding holes first, and patching fast, is the whole game.
How was today's edition? Tap one below, then tell me what you'd change on the next screen. I read every answer.
How was today's edition?
Thank you for reading. We’re all beginners in something. With that in mind, your questions and feedback are always welcome and I read every single email!
-James
By the way, this is the link if you liked the content and want to share with a friend.
Some * designated product links may be affiliate or referral links. As an Amazon Associate, I earn from qualifying purchases. This helps support the newsletter at no extra cost to you and Amazon makes a tiny hair less.
