This week on the Web Guy Nick Podcast, a WordPress security flaw let attackers run any PHP code they wanted on old servers, AI agents at a farm equipment company got passwords without ever seeing them, and Wall Street cooled on the big AI buildout. Alex, Jordan, and Nick sort out what actually matters for a small business, including the one question to ask your host in writing and why ten useful pages beat one hundred thin ones. Listen on Spotify, and if you want help keeping your own site patched and visible, you will find us at webguynick.com.
Listen to this episode on Spotify
Here is my plain English version. The safe move is not to wait for your host to save you. Check that your site is on a supported, patched version of P H P, and ask your host in writing how fast they patched and how they tell you. If nobody can answer that, you have found your real problem.
Nick
I tell clients the same thing about their websites and posts. Ten useful pages written from real jobs beat one hundred thin pages nobody asked for. The filter is coming for filler in every industry, so stop producing it now while it is still cheap to stop.
Nick
So the tip writes itself. Before you add agent number two, answer three questions for agent number one. Who did it act as, what did it do, and under which approval rule. If you cannot answer those from a log, you do not have an agent problem, you have a records problem.
Alex
Full transcript
Alex: Before we start: this podcast is produced with AI. Jordan and I are AI hosts, and Nick's voice is an AI clone of his real voice. Every story is researched from public sources, with links in the show notes.
Jordan: Here is the one that stopped me cold this week. Artificial intelligence found two flaws hiding in P H P for about twenty years, flaws rated nine point two out of ten, and governments started taking their own websites offline before criminals could use the same trick.
Nick: And P H P is not some side tool. It runs WordPress, and WordPress runs a huge share of the small business websites I manage every day. When that story broke, it stopped being tech news and started being my client list.
Alex: That is our week in one story, and it is the pattern for the whole roundup. Agents got more power, agents got new guardrails, and Wall Street asked what all of it costs. I am Alex.
Jordan: I am Jordan, and with us is Nick, who owns Web Guy Nick and spent part of this week checking client sites instead of reading headlines about them.
Nick: That is exactly right. So let us go story by story, and I will tell you what I am actually doing about each one.
Alex: Story one is the P H P emergency. Two critical flaws let an attacker run code on a vulnerable server with no login at all. Finland shut government web services for a while. Edinburgh council and the B B C took pages offline. Security agencies told anyone who could not patch fast to consider taking the system offline instead.
Jordan: The discovery is the twist. OpenAI says a firm called Calif found one flaw using its G P T five point six Sol model. A security firm called Wiz found both flaws on its own. One Wiz researcher said work that once took a world class team months now took about a week.
Nick: Here is my plain English version. The safe move is not to wait for your host to save you. Check that your site is on a supported, patched version of P H P, and ask your host in writing how fast they patched and how they tell you. If nobody can answer that, you have found your real problem.
Alex: And the clock changed. Cloudflare reported millions of attempts to exploit these flaws, so this was not a quiet warning period. OpenAI called the gap between discovery and disclosure a defender's window, the short time defenders get to patch before attackers catch up.
Jordan: Which connects straight to story two, because this week agents also got a better trust stack. On October twenty second, four rivals handed agent projects to one neutral home, the Agentic A I Foundation, under the Linux Foundation.
Nick: Say that in owner language, because foundations do not sound like money.
Alex: Fair. Anthropic gave it Agent Skills, the folders that teach an agent one job. OpenAI gave Open Responses, a shared way to talk to different models. Hugging Face gave OpenEnv, and Alibaba gave OpenSandbox, a locked room where agents run code safely. The foundation now holds ten projects, and no single company owns the rules.
Jordan: Anthropic says about one million skills have been published and nearly two hundred eighty million installs, and those are the company's own numbers, so treat them as a claim, not an audit. Still, the direction matters. A skill you write once can now work across more than seventy platforms.
Nick: That is the part I care about. I do not want to rebuild the same checklist five times for five tools. Write the process once, in plain text, and let the tools share it. That is also why I tell clients to keep their data exportable. Standards reward the business that can leave.
Alex: The second half of the trust stack landed the same day. OnePassword launched OnePassword for Agents, which lets an agent sign into a site without ever seeing your password.
Jordan: The agent proves who it is with a digital key, you approve or deny that one sign in on your own device, and OnePassword fills the password in itself. Launch partners include Claude Duet, the proactive agent we covered yesterday, plus agents from OpenAI, Meta, and Grok.
Nick: That approval step is the whole product. Never paste a password into a chat window and hope it stays private. If an agent needs a login, it should ask, you should approve that one job, and the password should never pass through the agent at all.
Alex: Story three is the reality check, and the numbers are blunt. A new survey from Nylas of one thousand thirty professionals found fifty four percent of companies had an A I agent make a mistake in the past ninety days.
Jordan: Most often the agent triggered a workflow the team then had to reverse. And only fifty three percent could produce a full audit log of what their agents did last week. The incident rate climbs with scale, from forty five percent for teams running one to five agents, to seventy percent for teams running more than twenty.
Nick: That matches what I see in small shops, just smaller. The Small Business and Entrepreneurship Council found fifty eight percent of small employers now use agents regularly or occasionally, with another fourteen percent planning to. Adoption is real. The log book is what is missing.
Alex: So the tip writes itself. Before you add agent number two, answer three questions for agent number one. Who did it act as, what did it do, and under which approval rule. If you cannot answer those from a log, you do not have an agent problem, you have a records problem.
Jordan: Story four is Wall Street blinking. On October twenty second the Nasdaq fell two point six percent and the S and P five hundred fell one point two percent, its worst day since July, on worries about debt funded data centers.
Nick: And Meta took the headline hit. Meta beat expectations, then fell about seven percent after third quarter capital spending of thirty four point nine billion dollars pushed its cash flow negative, with a new share plan to fund the build out on top. CoreWeave dropped ten point one percent and Nvidia fell four point four percent that day.
Alex: Here is what that does not mean. It does not mean the tools you use on Monday got worse on Friday. It means investors want proof the spending earns money back.
Jordan: And that proof question lands on owners too, in a good way. If a tool saves you three hours a week, keep it and say the number out loud. If you cannot name what it earned or saved, the market just showed you how that story ends.
Nick: Story five is Spotify and slop. Spotify said it has pulled more than fifty million slop and spam tracks out of its recommendations this year alone. Those tracks mostly stay searchable, but the algorithms and editors no longer surface them. That sits on top of more than seventy five million spammy tracks removed from the platform altogether.
Alex: Spotify also said tracks likely to be A I generated are ten times more likely to miss its one thousand stream royalty threshold, and more than three hundred thousand acts now hold its verified badge for human artists.
Jordan: The lesson is not really about music. Every platform is building a filter that asks, is this real work or mass produced filler. Search, social, and app stores are all moving the same way.
Nick: I tell clients the same thing about their websites and posts. Ten useful pages written from real jobs beat one hundred thin pages nobody asked for. The filter is coming for filler in every industry, so stop producing it now while it is still cheap to stop.
Alex: Time for Higgsfield Corner, our practical look at A I video for a local business. On October nineteenth Higgsfield launched Marketing Studio, with its Supercomputer layer on top.
Jordan: The workflow is simple to describe. Paste in a product page or a short brief, and it builds a brand kit from your own website, your logo, colors, fonts, and tone, then produces campaign assets from more than one thousand five hundred templates. Product shots, video ads, posters, and social clips, all from that one starting page.
Nick: I like the starting point, because a roofer or a print shop already has a product page. That page becomes the brief. But my rule from last week still stands. Check every generated image against the real product and the real job. A I video is a draft, not evidence, and never post a result your business did not actually deliver.
Alex: Judge it the way we always say. Not cost per generation, cost per finished clip you actually post.
Jordan: Now the game. A I or B S. Three claims, Nick calls them. Claim one. Spotify deleted those fifty million tracks completely, so they are gone from the platform.
Nick: B S. They were pulled from recommendations. Most stay on the service and searchable. The seventy five million figure is the separate full removal count.
Alex: Correct. Claim two. One company now owns the Agent Skills standard after this week.
Jordan: I will take this one. B S. It went the other way. Anthropic handed Agent Skills to a neutral foundation under the Linux Foundation, the same move it made earlier with M C P.
Nick: Claim three is mine to ask. Fifty four percent of companies in the Nylas survey had an agent make a mistake in the past ninety days. A I or B S.
Alex: That one is true, and it is the number I keep coming back to. More than half, in ninety days, and only about half could show a full log afterward.
Jordan: Time for missed it, our under the radar item. If you use Claude Code in auto mode, update it. Version two point one point three zero nine closed a real sandbox escape, where commands could run shell startup files outside the sandbox and even change the tool's own configuration file.
Nick: That is a small item with a big habit inside it. Update the agent tools the same week the update lands, the same way you update WordPress. An agent with old software is a helper with a known unlocked door.
Alex: What to watch next week. Three things. First, unpatched P H P sites, because exploit attempts are already in the millions and the window is closing. Second, whether the selloff calms or spreads after Meta's spending number. Third, the agent standards, because the test is who actually maintains those shared projects now that the press release is over.
Jordan: Which brings us to One Thing to Try This Week. Do the thirty minute patch and inventory. Update P H P, WordPress, plugins, and your agent tools. Then write down every A I tool connected to your business, what it can touch, and whether it keeps a log you can read.
Nick: One page is enough. Tool, what it can do, who approved it, where the log lives. That one page would have answered every hard question in today's episode, from the P H P patch to the agent that made a mistake nobody could trace.
Alex: So that is the week. A I found the flaw, agents got passwords without seeing them, and the winners were the owners who could prove what their tools did.
Jordan: Do the patch and inventory this weekend, and we will see you Monday with the next round of news.
Nick: And if your website is the thing an agent, a customer, or a search engine cannot read clearly, that is the work we do at webguynick dot com. Start with the one page inventory, and bring it with you.
