Founder, C4C Group. Independent tech advice for UK orgs: renewals, security, AI that works. Also building Page Forge and Get You In. Sussex.
Sussex by the sea, UK
Joined August 2009
- Tweets117
- Following836
- Followers273
- Likes1.5K
It's not just homes. Lift phones, alarm lines, card terminals and care alarms still sit on copper in plenty of UK organisations. Copper goes at the end of January. If nobody has audited what's still plugged into those lines, this week is a good week to start.
vSphere Express is doing the rounds in reseller briefings: fixed 128 cores, one year, reported to replace Standard and Enterprise Plus. Broadcom hasn't announced it. Before you sign, know your real core count and what Standard would cost on the same day.
c4cgroup.co.uk/guides/vspher…
Both big AI labs now show up by name in Chrome's security credits. Great for defenders. But if a model can find the bug in days, so can the next attacker's. Patch cycles measured in weeks won't survive that. Automatic browser and endpoint updates first, debate later.
interesting detail in chrome's latest update: of 52 security fixes, 6 are credited to anthropic's xinyang ge "assisted by claude", including 2 of the 4 critical ones. 4 more are credited to "openai codex security".
so both labs' models now show up by name in chrome's security credits.
anthropic says 62 cves (common vulnerabilities and exposures) that claude found are now patched as of chrome 156, all rated critical or high.
Peter Thiel reckons the human edge in the AI era is relationships. Golf with clients included.
As someone who sells independent advice and would rather talk on a tee than on a Teams call, I feel professionally vindicated.
AI can draft the proposal. It can't earn the trust.
I was listening to The Builders podcast where Walter Isaacson is interviewing Peter Thiel. Walter asks him what is the unique human edge in this era of AI. Peter goes silent for a whole 30seconds. I kid you not a whole 30s and then provides a very heartfelt answer which essentially boils down to "Human relationships". The whole podcast is worth listening to. Twice. I recommend you subscribe to that channel as well.
Youtube link : youtube.com/watch?v=H9Bdv3t5…
PHP runs a huge slice of the web. Two flaws that let attackers take over servers without logging in are being exploited now, and CISA has told US agencies to patch by tomorrow.
The fix shipped a week ago. The gap between patch released and patch applied is where breaches live.
A Japanese hosting firm said no to a $50m ransom. The hackers now leak its data daily, and Japan's Prime Minister called an emergency cabinet meeting.
Refusing to pay is the right call. But it's only a strategy if you can recover without them.
The test is simple. Could you rebuild from backups the attacker couldn't touch? And have you actually tried it this year?
If the honest answer is "probably", that's your gap.
We built a free, independent check for exactly that question. No pitch, just where you stand:
c4cgroup.co.uk/assessments/r…
Coinbase says it wasn't breached. Its analytics vendor was.
To the customer whose email leaked, that's a distinction without a difference.
Your attack surface is every supplier you've handed data to. Most organisations couldn't list them by Friday.
c4cgroup.co.uk/guides/vendor…
This is the bit boards should sit with.
Not "AI will hack us." AI made decade-old flaws practical to find and exploit at scale. Patching culture was already late. Now it is visibly too slow.
Basic hygiene and human risk still matter more than another shiny detector.
70% of websites run on PHP.
On October 21, two flaws in PHP scored 9.2 out of 10 each.
Unauthenticated remote code execution.
No login. No password. Run code on the server.
That is PHP2Shell, CVE-2026-109618 and CVE-2026-109619.
The detail worth sitting with:
Black October was not one attack.
It was eleven major failures in one October week, and nobody coordinated them.
That is worse, in a way.
A single villain you can blame, block, and brief against.
Eleven unrelated breaks means the system itself frayed.
Here is the cluster, in one breath:
PHP, the language behind about 70% of websites, cracked.
eMudhra, a certificate authority, had 8 intermediate keys so weak one was literally 4. About 30,000 certificates now need replacing.
Microsoft tied Storm-0940 to a ConnectWise supply chain compromise reaching 2,250+ cloud tenants, using ARTEX, an AI pentesting framework. Some victims went from first contact to privileged cloud access within 3 hours.
LiteLLM shipped a poisoned release that stole credentials. Stolen AWS credentials were tested about 4.5 hours after they were taken.
Governments in the Netherlands, Finland, and France took their own sites offline rather than leave them exposed. Wikipedia and the Internet Archive briefly went dark on October 21 too.
They were not hacked in that moment. They chose to go dark.
The timeline is the scary part:
Amazon spotted an exploit attempt on October 17, four days before the patch existed.
Cloudflare saw thousands of attempts in the 10 hours before disclosure.
Tens of thousands within 45 minutes after.
Hundreds of thousands within 2 hours.
Millions by the next evening.
AI found these flaws. Calif found one on August 1 using OpenAI's GPT-5.6 Sol. Wiz found them using Google's Gemini 4 Argon and Sol.
The bugs had sat in PHP for more than a decade. Humans could not practically crack them. AI could.
Not a smarter hacker. A faster finder.
Sam Altman said it plainly: I no longer think we are going to be able to patch all the bugs.
Anthropic's deputy CISO Jason Clinton called it a vulnerability tsunami, and said there will not be enough time to patch critical infrastructure.
The lesson is not patch faster, though patching matters.
Patching stops the next break-in. It tells you nothing about who already walked in before the patch.
What broke this week, the patch window or the idea that patching alone is enough?
Share this with someone who still thinks one update closes the case.
When AI finds vulnerabilities faster than teams can patch them, the next failure is often not the server. It is a person clicking the wrong thing while everyone is scrambling.
Email and insider risk do not pause for a CVE week.
c4cgroup.co.uk/security/
Mastercard opened Agent Pay for Machines: AI agents buying within a budget you set, on crypto rails.
The real product is not the payment. It is the spending limit.
If agents can move money: who sets the cap, who sees the trail, and what happens when the agent is wrong.
They're calling it Black October, and for once the label fits.
AI helped uncover critical PHP flaws under a huge share of the web. Attempts jumped to millions in hours. The uncomfortable bit is not the CVE. It is the speed of finding vs fixing.
theguardian.com/technology/2…
