On Oct. 21 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated attacker run code on a server running PHP. The PHP Foundation says full code execution was demonstrated with default settings on Apache with mod_php, and tells everyone who runs PHP to update now.

PHP runs most small-business websites, including every WordPress site. Take an 18-person plumbing company with a WordPress site and a booking form that stores names, addresses and phone numbers. On a managed WordPress host, the patch is likely already applied and costs nothing. If a freelancer built the site in 2019 on its own server and it still runs an older PHP branch, no patch exists for that branch. The fix is an upgrade to a patched version, which can break an old theme or plugin; assume 4 to 10 developer hours. A site on a hosted builder such as Wix or Squarespace has little to do. A self-hosted client portal at an accounting or law firm is urgent. Details are public, so waiting costs more each week.

On Oct. 21, 2026, Anthropic announced Claude Duet, an AI agent for professionals and small business owners built on Claude Opus 5.5, launching as a research preview on iOS, Android and Claude on the web. It sends a morning brief from connected apps, messages you when something needs attention, takes tasks from scheduling meetings to building forecasts and web apps, asks for approval before steps like sending a payment or deleting something, and is waitlist-only for US Pro and Max subscribers.

This is the first agent from a major AI vendor pitched straight at small business owners, not developers. Take the owner of a 22-person HVAC shop who spends about 45 minutes each morning going through email, the calendar and overdue invoices. If Duet's brief cut that to 15 minutes, that would save about 30 minutes a day, roughly 10 hours a month, or about $750 at $75 an hour of owner time. That saving is unproven. Anthropic says the agent 'still might misread a thread or miscalibrate what's urgent,' and the coverage does not list which apps connect, so do not assume QuickBooks, ServiceTitan or your dispatch board work. Owners who already pay for Claude Pro or Max and live in email and calendars should watch this. Owners outside the US, or whose day runs through field-service software Duet may not reach, can ignore it for now.

On Oct. 20, 2026, Zapier said multiple AI tools such as Claude, ChatGPT and Cursor can now connect to a single Zapier MCP server and share its apps, actions, skills, mode settings and tool-call history, instead of each tool needing its own server. The feature is available now in Zapier MCP, which is included in every Zapier plan, and adding clients to a server requires Owner or Editor access.

This is a housekeeping fix, but a useful one. Take an 18-person accounting firm where the two partners use Claude and the admin staff use ChatGPT, each connected to QuickBooks, Gmail and Slack through Zapier MCP. Today that means two servers: two lists of allowed actions to maintain and two histories to check when someone asks what the AI did. On one shared server there is one action list and one log. In managed mode the owner picks exactly which actions each tool can run. For example, the AI can draft a Gmail reply but cannot touch QuickBooks. The owner can also lock the Slack channel so updates always post to #billing. There are two catches. Skills only work in agentic mode, so a managed server shares apps and actions but not skills. And a tool can sit on only one server at a time, so moving it switches it to the new server's mode. Firms with two or more Zapier MCP servers should care. Firms that don't use Zapier MCP, or use only one AI tool, can ignore this.

OpenAI said on Oct. 21, 2026, that ChatGPT Ads is expanding to 26 more countries and that more than 100,000 advertisers have used the platform. The company pitches the product to everyone from local businesses to global brands as a way to reach people while they explore, compare and decide what to buy in ChatGPT.

Editor note: the source page returned HTTP 403, so these facts come from OpenAI's headline and feed excerpt only. The country list, pricing, minimum spend and targeting options are unconfirmed. The news is about scale, not a new feature for you. OpenAI is telling advertisers that buyers now ask ChatGPT which provider to pick, and it wants local businesses paying for placement there. Take a 15-person plumbing company that spends an assumed $2,000 a month on Google Local Services Ads at about $60 per booked lead, or roughly 33 leads. Moving 10% of that budget, $200, into ChatGPT Ads only makes sense if you can track calls from it and it beats $60 a lead. With no published cost-per-click data, local targeting detail or call tracking, you would be paying to find out. Owners who sell to consumers comparing options, such as remodelers and HVAC replacement shops, should watch the next update. Firms that win most work by referral, including most accounting and law practices, can ignore it.