Most weeks this newsletter is about what AI can do for your business. This week the biggest story is about what AI found: a serious security hole in PHP, the software behind a large share of the web, including every WordPress site. The fix came out this morning.
So we start there, with what to ask the person who runs your website. After that: Google's new small business tools in Gemini, a burger shop that learned what customers think of generic AI images, and the question more owners are asking, which is why ChatGPT doesn't mention them. As always, each item links to the original, and engagement numbers are as of the morning of October 21.
1. AI helped find a serious flaw in PHP
@OpenAI, October 21. About 2,200 likes, 440 reposts and 190,000 views in under an hour.
OpenAI said its models helped researchers in its Patch the Planet program find critical security flaws in PHP, the open-source language that runs an estimated 70% of websites. For two months it worked with PHP's maintainers, researchers and security companies to prepare a fix before going public, because the fix needed a major change to the PHP engine. OpenAI called it "one of the most impactful vulnerabilities in recent memory" and said every PHP site can now upgrade.
According to X's news summary, the PHP project released the emergency update at 14:00 UTC on October 21 (10 a.m. here in Massachusetts). It covers two flaws that could let an attacker take over a server remotely, rated 9.2 out of 10 for severity, and affects many versions including PHP 8.2 through 8.5. The summary also says Cloudflare reported early attack attempts.
Our take: If your website runs on WordPress, it runs on PHP. You don't need to understand the bug. You need to know someone updated your site today. If you're on managed hosting, your host may handle the PHP update for you, but ask and get a yes in writing. If a freelancer or nephew built your site years ago, call them this afternoon. While they're in there, have them update plugins and themes and confirm there's a recent backup.
2. Who patches your site this week?
@levelsio, October 21. About 1,100 likes and 170,000 views.
@levelsio, who runs several profitable one-person websites, said he took all of his sites and servers offline ahead of the patch and suggested other PHP site owners consider doing the same until they update. In a follow-up (about 1,000 likes), he said he warned a friend whose tech company runs on PHP, and the friend replied that he'd "try patch it in a few days" because he was out of office. His worry: once a fix is public, attackers can study it to work out the flaw, and plenty of sites won't update in time.
Our take: Taking your site down is a big call for a contractor who gets calls from it, and most owners won't need to. But the friend's reply is the real lesson. Every business website should have a named person responsible for updates, with a phone number you can reach on a weekday. Write it on the same list as your plumber, your accountant and your insurance agent. If the honest answer is "nobody," that's the thing to fix this month.
3. Google adds a small business hub to Gemini
@CodeByPoonam, October 21. A smaller post so far, but it's the clearest rundown we saw of news that broke this morning.
According to the post, Google added a business hub inside the Gemini app for branding, finances and customer insights. You upload your logo, fonts and brand colors once and Gemini uses them for posts and product images. You can drop in messy spreadsheets or receipts and get simple charts back. It connects to Google Business Profile, Google Ads and Workspace, plus apps like Canva, Shopify, Zoho and Xero. The post says it's rolling out to Gemini app users over the next few days.
Our take: We haven't tried it yet, so treat this as a heads-up, not a review. The Google Business Profile connection is the part that matters most for local trades, because that profile is what people see when they search "plumber near me." If you try it, set up the brand kit first so everything looks like you, and read anything it writes before it goes on your profile or your ads.
4. When AI images make customers tune out
X's news summary, October 21.
A young burger delivery spot in Lagos, Nigeria drew a wave of criticism on X after people noticed its promo images were made with tools like ChatGPT. Many called them ugly and generic, and the memes followed. A day earlier, @leilamakes (about 190 likes) put the problem in one line while pitching a design tool: "If your AI-generated ad could belong to literally any brand, is it even branding?"
Our take: Customers can tell, and some of them read it as a shortcut. For a trade business, the best marketing photo you own is a real one: your van in a customer's driveway, your crew on a clean install, the panel you just upgraded. Use AI to write the caption, resize the photo or plan the month of posts. Keep the people and trucks real.
5. "Why doesn't ChatGPT recommend me?"
@noahkagan, October 21. Posted this morning.
Noah Kagan, who runs the software deals site AppSumo, looked at 12 months of AppSumo sales to answer a friend's question about what to build. By his numbers, the median AI agent product sold $17K, while the median tool for getting found in ChatGPT sold $257K, the top category on his list. His explanation: every business owner is asking the same new question, "why doesn't ChatGPT recommend me?"
Our take: You don't need a special tool to start. AI assistants lean on the same signals that help you on Google: a complete Google Business Profile, the same business name, address and phone number everywhere you're listed, a clear page for each service and town you cover, and recent reviews from real customers. Get those right first. Then ask ChatGPT for "the best electrician in [your town]" and see who comes up.
One more for the tech crowd
PHP wasn't the only patch day. According to X's news summary, version 1.107.0 of LiteLLM, a popular Python library for connecting apps to AI models, was published to PyPI with malicious code that steals SSH keys, cloud credentials and browser passwords. The summary says PyPI pulled it and security teams advise pinning to 1.106.2, rotating credentials and cleaning up infected machines. If you build with AI tools, check your lockfiles today.
That's issue eight
If you're not sure who updates your website, or whether it's on PHP, write to us at support@eighteye.ai and tell us what you're working with. Eight Eye is the AI growth partner for small businesses. We answer and follow up with every lead, help you get found in search and AI answers, and keep the busywork moving. See how it works, compare plans and pricing, or book a demo.
See you in the next issue.