Fri, October 23, 2026
3-minute read
3
DID YOU SEE
2
WORTH TRYING
1
FUN FACT
👋 Good morning.
If your website runs on WordPress, it runs on PHP, and this week PHP had one of the worst security holes in years. Governments in Belgium, France, Germany and the Netherlands took their own sites offline to patch it, per the Guardian. Checking yours takes one email.
Yesterday, 29% of you would hand a proactive agent your inbox first, 29% your calendar, and 29% nothing yet. Invoices got 14%.
THIS WEEK IN LABS
Live Q&A with Kushank
Today, Fri Oct 23 · 10–11 AM PT / 1–2 PM ET
Labs members bring the AI questions they're stuck on, and Kushank answers them live, one by one: what works, what doesn't, and where AI still needs a human. The replay and notes land on the session post afterwards.
IN 3 MINUTES, GET 1% BETTER THAN EVERYONE YOU KNOW:
Is your website exposed to this week's PHP flaw?
Your AI agent logs in, never sees the password.
Canva's new image model can finally spell.
Build an Arduino and a BILLY bookcase in 3D.
AI builders expect it to do 75% of their jobs.
3 Did you see
Image: OpenAI
Two flaws, called PHP2Shell, let an attacker who isn't logged in run code on any server on PHP 5.4 or later, per Cloudflare. PHP runs almost 70% of websites, WordPress included. Calif found one with GPT-5.6 Sol for OpenAI's Patch the Planet, and Wiz found both independently. Belgian, Dutch, French and German governments took sites offline to patch, per the Guardian, and Amazon caught an exploit attempt four days before disclosure. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and updating a plugin doesn't help.
Do this: Email your host today and ask “which PHP version are we on, and is it one of the four fixed releases?”, or run OpenAI's free php2shell-checker on your site, remembering an UNKNOWN result doesn't mean you're patched.
Your web host’s inbox is about to get busy.
Do you know which PHP version your website runs on?
1Password for Agents launched Oct 22. When your AI agent hits a login page, it asks 1Password for that one credential, you approve, and 1Password fills it into the site. The agent never sees the password or one-time code and can't browse your vault. It's free on Individual and Family plans on 1Password.com, not yet on .eu or .ca accounts. Muse and Grok Bot roll out over the coming days, and Claude Duet, ChatGPT Work and dots are “coming soon,” per The Verge.
Do this: Stop pasting passwords into agent chats, and join the waitlist for the agent you actually use.
Your agent gets the door opened, not the keys.
Canva released Canva Craft on Oct 22, its first in-house image model. Instead of drawing pixels straight from your prompt, it first plans the layout, scale, hierarchy and text, then renders, so it's built for posters, slides and promo shots. It outputs up to 2K, writes text in 55 languages, and is live for every Canva user in Dream Lab and through the API, per TechCrunch. Each image uses your AI credits and takes 50 to 60 seconds, per Canva's developer notes.
Do this: Next time you need a promo graphic with words on it, generate it in Dream Lab and split it into editable layers with Magic Layers instead of fighting a flat image.
Spelling is now the model’s job.
2 Worth trying
1. 🤖 Robotics Bench · free · in your browser
Thirteen real boards, Arduino Uno to Raspberry Pi 5, that you build part by part in your browser: place parts, solder the joints, plug in USB, upload a sketch, pass the quiz. Its creator made it with Opus 5.5 and the colorfigures skill so you learn what a resistor does before spending $1,000 on a starter kit. The catch: it teaches what the parts do, not how to wire your own project.
2. 🪑 Flat Pack · free · in your browser
Flat Pack turns IKEA's printed manual into a 3D model that builds step by step. You can orbit it, pull it apart or click any part to see what it is. It starts with the BILLY bookcase, keeps the manual's own part numbers and step order, and lets you switch to other pieces. The catch: board thickness and hole positions are eyeballed from the drawings, so trust the paper manual for measurements.
1 Fun fact
Anthropic surveyed 10,980 US adults and 1,334 of its own staff in August for The AI expectations gap (Oct 16). Staff expect AI to handle 75% of their own work by 2030; US workers say 28%. A Nobel-level AI discovery by 2030: 91% of staff vs 39% of adults. AI cutting a task to a quarter of the time or less: 59% of staff vs 26% of adults who use AI at work.
Do this: List this week's tasks and mark the ones AI could already do; if your share is nowhere near 75%, that gap is your to-do list.
Nobody there is asking if anymore, only how fast.
Don't forget to rate today's post
That's your 1% for today.
Kushank, AI teammates, and the human team
PracticalyAI
Running a small business and want to build AI automations? Book a call with my trusted delivery partner.
