Three Stories This Week, and the First One Is Urgent
Unusual week: the most important story does not come from a model launch, it comes from a security flaw. A critical vulnerability was found in PHP, the programming language running the majority of the world's websites, and it was found by artificial intelligence tools. Alongside that, OpenAI crossed a threshold with its advertising business, and Microsoft confirmed when the Copilot bill for smaller companies stops being fixed.
Three stories, three different muscles: your security, your acquisition, your budget. None of them needs a big project. All of them need one named person on them this week.
The PHP Flaw AI Found, and Why It Reaches You Even Without a Technical Site
On October 21, the PHP Foundation, the organisation that maintains the PHP language, shipped an emergency fix for two flaws grouped under the name php2shell. Both allow what is called remote code execution: a stranger, with no password and no account, can run their own program on your server. Every version released in the past decade is affected, and PHP runs most of the web, WordPress first among them. They were found by teams at Wiz, the security company Google acquired, and at OpenAI, using AI tools built to hunt for this kind of defect. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and exploitation attempts were observed almost immediately, before most sites had applied the fix.
Why this matters to you. Your site probably runs on PHP without you knowing it, and clean application code does not protect you: the defect sits in the engine, not in what your team wrote on top of it. But the real story goes past this one patch. The flaw sat there for ten years; it took AI tools to surface it. Those same tools exist on the other side, and the gap between finding a defect and exploiting it just compressed. Your patching delay is no longer IT hygiene, it is an exposure.
What I would do. Today, one message to your host or your agency, three questions: which PHP version runs on our servers, is it patched, and were the processes restarted after the update. That last one gets forgotten constantly and leaves the site vulnerable while the fix sits installed. Then the structural part, worth more than this patch: name someone, by name, whose job is to apply a critical fix within forty-eight hours. At B&Inside, the question was never whether a flaw would land, it was who picks up the phone when it does.
ChatGPT Advertising Leaves the Experiment Phase
On October 21, OpenAI opened its ad platform to twenty-six new countries and said more than a hundred thousand advertisers had run a campaign since launch. France is not in this new wave: it got access back in the August European opening, so you can already buy. Ads only appear for people on the free and Go plans, and buying happens self-service through OpenAI's campaign manager. The hundred thousand figure is cumulative since launch, not the number of advertisers buying today. OpenAI announced the next phase in the same breath: new formats, new campaign objectives and, above all, measurement tools.
Why this matters to you. In September I wrote here that for Europe there was nothing to buy and that waiting was the right call. That answer no longer holds. Ad inventory nobody is fighting over yet is a window, and it closes as the queue fills. The counterweight is just as clear: measurement is the weak spot, and the fact that OpenAI is only now announcing it tells you where this channel sits on the maturity curve. You are buying a real audience on incomplete attribution.
What I would do. A test budget this month, deliberately small, treated as learning rather than acquisition. One product, one landing page dedicated to this channel, because that is currently the only honest way to know what it returns, with the question asked directly in your form. I would not move a single euro of Google Ads budget to fund it. At Le Dressing de Paolina, the 38% conversion lift never came from the channel, it came from what happened after the click. That will be the limiting factor here too.
Your Microsoft 365 Copilot Bill Stops Being Fixed on December 1
Microsoft is changing how it bills Copilot Business, the version of its assistant aimed at small and mid-sized companies. Until now, a fixed price per person per month. From December 1, every new licence bought through an authorised reseller arrives with usage-based billing switched on by default: beyond what the subscription covers, consumption is counted in Copilot Credits and billed on top. The default ceiling is four thousand credits per person per month, roughly forty dollars that can land on top of each person's subscription. Subscriptions already running do not switch over. Microsoft first announced November 2, then pushed the change to December 1.
Why this matters to you. A predictable line in your budget turns variable, by default, without anyone on your side having made that call. Across fifty people, the theoretical ceiling adds up to around two thousand dollars a month. It is a ceiling and not a flat fee: you only pay for actual usage. But a default setting nobody read is the exact mechanism behind a surprise on the February invoice. Several resellers also point out that once it is on, usage-based billing does not switch off: it gets capped, possibly at zero.
What I would do. If you are buying new Copilot Business licences before December, settle the spending limit in the same conversation as the price, not afterwards. If your licences are already in place, there is nothing to do and I would leave them alone. Either way, the cap is set in the Microsoft 365 admin centre under cost management, and I would set it by group rather than globally: your sales team and your finance team do not have the same usage. Ten minutes of setup before signing beats a negotiation after the first invoice.
Everything Else, in Three Lines
Anthropic opened a research preview of Claude Duet, an assistant that comes to you instead of waiting for your question, US only and behind a waitlist: nothing to decide there yet. OpenAI is making its models available through Google Cloud, which concerns your technical team and nobody else. And the week brought a parade of model releases from Mistral, Alibaba, DeepSeek and MiniMax: nothing that changes your decisions.
See You Next Friday
The thread running through this week is not the one anyone expected. We have talked about AI for two years as a productivity subject, and this week it arrives through security, through your ad platform and through your software invoice. Three different doors, and that is what makes the week instructive: AI has stopped being a subject you handle in one place.
None of the three calls for new budget. All three call for a decision, and one named person per subject. If one of them speaks to you directly, the PHP fix on your site, a first advertising test inside ChatGPT or the arbitrage on your Copilot licences, let's talk. See you next Friday.