The Download

Illustration: Morning Brew Inc., Photo: Adobe Stock

TL;DR: If “PHP” has been popping up on your feed this week, you’re not alone. It’s all anyone can talk about as websites and apps around the world (including plenty you use) race to update after cybersecurity researchers discovered two flaws in PHP, the coding language that runs most of the internet. It’s why you may have noticed some sites go dark at unexpected times in the past few days.

What happened: Your company’s CTO could probably use your thoughts and prayers right now—one said he didn’t sleep for days after the flaws leaked on Tuesday. PHP developers released an emergency fix on Wednesday for the two flaws, which could let hackers take over a website without needing a password. Amazon also found hackers trying to exploit the flaws four days before the fix was out, and urged sites to update immediately. No breaches have been confirmed so far—although attempts to exploit the bug jumped from thousands before the announcement to millions by Wednesday night, per Cloudflare’s CEO.

Though they only recently disclosed this to the public, researchers at OpenAI and two security firms found the bugs over the summer using AI. A limited version of the problem was actually flagged in 2024 but was brushed off as too hard to exploit—a moot point now given AI’s rapid progress.

What exactly is PHP?: It’s the programming language behind roughly 70% of websites, so a flaw in PHP leaves a lot of the digital world vulnerable (including sites with sensitive information, like government portals and online stores). PHP largely relies on volunteers to help maintain it (including this one man who is now being hailed as the unsung hero of the internet).

Why you should care: Attackers can exploit these vulnerabilities to get into a website’s server (where its data lives) and steal everything from passwords to personal information, or use the site to spread malware to the people who visit it. The NSA advised any organization that couldn’t install a fix right away to consider going offline until it could. Many did: Websites in the US and around the world started going dark on Wednesday.

Bottom line: If a site or app you use is down this week, this may be why. And if it tells you to update your password, take it extra seriously right now (and make sure they aren’t recycled). —LC

      

Sponsored By Cisco

Optimism and vigilance aren’t rivals. Think good cop/bad cop: two halves of one strategy, and the companies getting AI right run both at once.

Start with perspective: AI is a powerful evolution of software, not a new species (sorry, sci-fi fans). Cisco has spent three decades on the cybersecurity front lines, through the cloud and the broadband boom, and that muscle memory remembers.

History also says innovation runs faster than safety. The light bulb and the automobile both showed up first. Closing that gap takes intentional, systemic design. Modern aviation stays safe because strict protocols are engineered into the whole system.

Now, collaboration is expanding to people working with AI and agents working with other agents. Connected intelligence needs that same architecture, plus trust, which grows through transparency and sharing.

Cisco is building that for the future, and the work is happening right now.

The Zeitbyte

The Airbnb chore wars

Illustration: Morning Brew Inc., Photo: Adobe Stock

For years now, Airbnb users have faced a growing annoyance: Enjoy that Stunning 5BR Oceanview Retreat w/ Hot Tub—but, before you leave, don’t forget to do the dishes, wash the sheets, take out the trash, and oh, mow the lawn while you’re at it. This week, the short-term rental platform officially announced that asking guests to do time-consuming chores (like stripping the bed) is mostly not allowed anymore—and kicked a veritable hornet’s nest online.

One Redditor on r/airbnb_hosts compared the company to “an abusive partner,” while another wrote, “I kinda hope the whole platform goes down.”

Some hosts say they’re now considering leaving the platform, while others are cooking up ways to get around the policy, like moving house rules to another section of the listing (which the new policy also appears to bar). A few are grousing that the change limits what kinds of rules hosts can set at all—things like smoking bans are fine, but anything outside of Airbnb’s pre-set categories now has to go under “requests.” (“Changing my WiFi name to ‘only flush toilet paper,’ reads one Reddit comment.) Still, other hosts approve of the policy change, saying the taskmasters with long to-do lists gave the rest of them a bad name. Just don’t be surprised if your next Airbnb comes with an eye-watering cleaning fee. —WK

Chaos Brewing Meter: ☕☕/5

• A major medical diagnostics firm that serves one in three US adults each year got hacked this week—and that means your medical data could have been exposed.
• This small change to the YouTube mobile app may have a big impact on how you navigate the platform.
• At the center of the OpenAI firing researchers controversy are…disappearing Signal chats?
• Some US banks are starting to block AI agents—because they’re becoming a “nightmare” for security.
• It’s official: Spotify is coming for your Family Plan, but says it’s a “routine improvement.” Sure, sure…
• Amazon’s new Kindle+ subscription looks great on the surface, until you realize what’s up with the added audiobooks.
• A WhatsApp feature users have long begged for is finally coming to iPhones.
• Does opting out of user tracking on your smart TV actually do anything? Researchers dug in, and are revealing some suspicious findings.

^{*A message from our sponsor.}

This time last week...

Readers’ most-clicked story was about the Tesla Roadster 2 finally being unveiled. Watch it in all its kick-flipping glory here.