SODP Dispatch - 29 October 2026

A critical flaw affecting 70% of all websites has the cybersecurity world panicked

By Andrew Cullen

Details have been published of a critical flaw in the programming language PHP, which is the backbone of more than 70% of all websites. Left unfixed, the flaw would allow hackers to easily take over and compromise millions of websites and the information held on their servers. In response, multiple European governments and operators including the Port of Rotterdam have taken websites offline.

The Australian Signals Directorate, America’s Cyber Defence Agency, and similar bodies from the United Kingdom, Europe and Japan have all warned web developers to apply urgent updates to their core systems, and to consider taking down websites until safety can be guaranteed.

The organisation behind the free, open-source language has published updates that patch the flaw, but performing the updates on the millions of systems that use PHP will take time.

What is PHP?

PHP is often called “the backbone of the web”. It’s a programming language – a way to give instructions to computers – that has been around since 1997, and it allows websites to manage user inputs and process information behind the scenes.

The power of PHP is its versatility. Websites use it for everything from logging users into accounts and running online stores, to requesting data from databases and powering millions of blog posts and news sites.

💬 We want to hear from you: If a flaw like this hit your site tomorrow, who would patch it, and how quickly could they do it? Hit reply and tell us; we read every response, and yours might help a future issue.

📊 PubTech 2026: Build, Buy, Own with WordPress VIP

Every publisher conference this year will tell you search referrals are down. That is last year's conversation, and the room already knows the number.

That gap is the theme of PubTech 2026. On 10 November, we're bringing 40 publisher executives into one room in London to answer three questions about their own businesses:

→ What's worth building?
→ What are you still paying for that you'd never buy today?
→ What do you own that someone should be paying you for?

It's the fourth PubTech, with a US edition online the same day.

The room is built for the people who decide what gets built, what gets cut and what the business charges for: CEOs, Managing Directors, Founders, CPTOs, CTOs, CPOs, Chief Digital Officers and Chief Data & AI Officers. Seats are two per business, pairing the person who signs with the person who builds.

📅 Tuesday, 10 November 2026
📍 Old Queen Street Café (The UnHerd Club), 6 Old Queen St, London SW1H 9HP
Time:
→ 08:30 doors, 09:00-13:30 London, including a Lunch & Learn with Viafoura
→ 15:30-17:30 London / 10:30-12:30 ET: US edition, online, free and open to all
→ 18:00-21:00 drinks and private dinner, invite-only, hosted by MonetizationOS

What you walk away with:

✅ The Ownership Audit: a one-page snapshot of your build-buy-own position across CMS, data, paywall, ad stack and audience
✅ The Ownership Ledger: the room's answers, consolidated, anonymised and circulated to everyone who attended
✅ A benchmark of where your build-versus-buy line sits against your peers
✅ Three bets for 2027, committed to by the room, sent to all participants in a post-event ebook

Here are confirmed speakers so far that will be joining me:

• Peter Barr-Watson, Chief Product & Technology Officer, The Independent
• James Hill, Media & Publishing Lead EMEA, WordPress VIP
• James Henderson, Founder & CEO, MonetizationOS
• Mads Holmen, Head of Product (Platform), MonetizationOS
• Courtney Jarrett, Head of Product (Customer Experience), MonetizationOS
• Matthew Karolian, VP Platforms & AI, Boston Globe Media (US edition)

No panels, no product demos, no slideware. Working sessions under the Chatham House Rule: use what you hear, reveal no participant or affiliation.

There's no ticket price, and every application is answered personally.

Do you want a seat in London? Apply using the link in the comments. Can't make it? Join the US edition online, free, and you'll still get the post-event ebook.

Thank you to WordPress VIP, MonetizationOS, Ezoic, Multidots and Viafoura for partnering with us.

Apply for your seat or join the US edition here▸

🎯 LiveRamp × OpenAI: Measure Your ChatGPT Ad Performance

If you're running or planning ads on ChatGPT, you can now close the measurement gap. LiveRamp's Conversions API (CAPI) Hub connects directly to ChatGPT ad campaigns via secure server-to-server data connections, meaning you get reliable conversion tracking without depending on browser-based signals that often break or go missing.

In practice, this means you can:

• See which ChatGPT campaigns are actually driving conversions — not just clicks

• Optimize spend in real time based on accurate performance data

• Justify and grow your ChatGPT ad budget with measurement data you can trust

As consumer journeys shift toward AI-powered platforms, this gives marketers the infrastructure to keep up, connecting data, measuring impact, and proving ROI on one of the fastest-growing ad surfaces in the world.

Read more ▸

By Vahe Arabian

📰 Build Less, Build Smarter: Where Publishers Should Spend Engineering Hours

An in-house build is a commitment of roughly 3 to 7 times its quote. Benchmark research from ISBSG puts maintenance at 65 to 85% of an application’s total ownership cost. That leaves the build itself at just 15 to 35% of the real bill.

That isn’t a case against building. It’s a case for building in the right places.

Build what touches your audience, your data or your editorial edge: recommendations tuned to your readers, a paywall that knows your subscribers, a data product for a niche nobody else serves. Buy the commodity layer. Email delivery, login, ad serving and basic analytics are solved problems, and every engineering hour spent maintaining them is an hour not spent on what makes you different.

Before your next build is signed off:

• Ask whether it touches your audience, your data or your editorial edge. If not, buy it.

• Multiply the quote by 3 to 7 and check the business case still holds.

• Name the team that will maintain it after launch.

• Book a review 12 months out: keep, rebuild or replace.

PubTech 2026 takes place on Tuesday 10 November in London, where 40 publisher leaders will work through three questions about their own businesses: what is worth building, what they are still paying for that they would never buy today, and what they own that others should be paying them for. It is a closed-door session, and we will publish its conclusions after the day. A US edition runs online at 15:30 London time (10:30 ET).

Apply for a seat here.

What publishers learned with OpenAI about agentic AI and audience growth | INMA

The technology can move quickly. Getting an organisation ready to use it well takes more work. That was a recurring theme at last week’s INMA Audience Growth Workshop with OpenAI in San Francisco (part of our Media, Tech & AI Week). We brought together a small group of senior news media leaders to explore where agentic AI could help solve real audience challenges and what would need to happen inside their organisations to make that possible. Across the discussions, six conclusions stood out.

Read more ▸

Vox launches its first app with an eye toward building paid memberships | Nieman Lab

Vox has launched its first mobile application, the publication best known for its explanatory journalism announced Wednesday morning. The app, which puts Vox’s text, audio, and video in one feed, is the company’s latest bet on growing paid membership. Users can choose between a home tab of featured pieces or a chronological feed of the latest stories. While the app is free to download and browse, it’s catered toward serving Vox journalism to paid subscribers in one place.

Read more ▸

A surprising tech revival holds an important lesson for news media publishers | Editors & Publisher

When did you last take a picture with your camera? Not your phone. An actual camera. A device whose only job is to make photographs. I asked a room full of media executives this question last spring and watched them pause. Most had to think back years. Some couldn’t remember at all. That pause tells you everything. For a decade, the story was clean and obvious: smartphones killed the point-and-shoot camera.

Read more ▸

Google expands AI Search ads globally as core ad growth slows | TechCrunch

Google is bringing ads in its AI-powered Search experiences to international markets, betting that generative AI can open up new revenue opportunities even as growth in its core search advertising business slows. The announcement came Wednesday during Alphabet’s third-quarter earnings call, as the company reported $127.6 billion in revenue, up 25% year over year. But Search advertising growth continued to decelerate, and Alphabet shares fell 8% following the results.

Read more ▸

Your next reader may never land on your website - where else can you provide value? | JournalismUk

A few years from now, your reader may ask their assistant what the new planning proposal means for their street. The assistant pulls from hundreds of sources, checks them, folds in what it knows about their commute and mortgage, and hands them an answer. Your article might have been one of those sources. The reader never saw your homepage or your headline, and they never learned your name. That scenario sits at the heart of a September 2026 report called Value in the emerging AI-mediated information ecosystem.

Read more ▸

Why the SEO industry needs in-person meetups | Search Engine Land

Where did everyone in SEO go? There was a time when you could open Twitter and find just about everyone in the SEO industry. People were sharing tests, discussing algorithm updates, asking questions, and arguing about whatever Google had changed that week. Now, everyone’s somewhere different. Some people are on LinkedIn. Others moved to Bluesky or Threads. There are Slack communities, Discord servers, private group chats, and plenty of people who aren’t nearly as active online anymore.

Read more ▸