Who this is for

  • Finance brokers
  • Legal firms
  • Accounting firms
  • Consultants
  • Trades
  • Clinics

The stories

AI found the flaws that took government websites offline this week, and Node.js was the second one

Node.js fixes published 21 October; Reuters report 23 October 2026

From Wednesday, government websites in Europe and elsewhere went offline after two critical flaws were found in PHP, the software behind most websites including WordPress. In the UK, LBC reported dozens of government and police sites down, including the Met Police website and Edinburgh and Oxford council sites, with errors on Bristol, Lambeth and Barnet council sites.

The same day, Node.js, the software that runs many modern booking systems, customer portals and web apps behind the scenes, published fixes for ten security holes. The most serious lets an attacker run their own code on a server by sending it a malformed compressed file. It was found by OpenAI's Codex Security team, an AI system that hunts for software flaws. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older get no fix at all.

Reuters spoke to seven security professionals who said AI has uncovered a stream of new software flaws that are almost certain to cause more disruption. Cloudflare chief executive Matthew Prince said he knows of "a bunch of additional severe vulnerabilities" in other critical software and expects "a couple years where every single week it's going to feel like the sky is falling". Research firm VulnCheck says AI helped double the number of flaws discovered year on year.

OpenAI switched off GPT-3.5, GPT-4, GPT-4 Turbo, o1 and o3-mini on Friday. If an automation went quiet, this is why.

Shut down 23 October 2026, announced 22 April

On Friday OpenAI shut off access to a long list of older models for anyone using them through its developer connection (the API, the plumbing that automation tools and plugins use rather than the ChatGPT app). The list includes gpt-3.5-turbo, gpt-4, gpt-4-turbo, the May 2024 version of gpt-4o, o1, o1-pro, o3-mini, o4-mini and the gpt-image-1 image model, plus any fine-tuned copies of them. A request to any of those names now fails.

Who this hits: anyone who had a Zapier or Make step, a WordPress plugin, a website chatbot or a quoting tool set up in 2024 or early 2025 and never touched since. Whoever built it will often have typed the model name in once and left it. OpenAI's suggested replacements are gpt-5.6-terra for GPT-3.5 and o4-mini, gpt-5.6-sol for the GPT-4 family, o1 and o3-mini, and gpt-image-2.5 for images.

More dates are coming. The gpt-image-1.5 image model goes on 1 December. The gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-pro, o3 and o3-pro models go on 11 December. OpenAI's Agent Builder and Evals dashboard close on 30 November.

Clear takeaways

  • Security fire drills are now a weekly event. AI found these flaws, patches land fast, and the only protection is knowing who patches your site and how quickly they do it.
  • Software you set up once and forgot is the risk in both stories. Things that worked for eighteen months broke in a single week.
  • Keep a one-page "what runs us online" list: site platform, host, who patches it, and which AI models your automations call. It turns a scary headline into a five-minute check.

Do this now

  1. Email your web developer or host today: "Which PHP version and which Node.js version are we on, and were both updated on or after 21 October?" A passing reply names the versions and the update date. If Node.js is version 20 or older, no fix exists and it needs upgrading.
  2. If your site is on WordPress with a big hosting company, open the host's status or blog page and look for a PHP2Shell notice confirming they patched.
  3. Open Zapier or Make, filter your automations for OpenAI steps, and read the model name in each one. If it says gpt-3.5-turbo, gpt-4, gpt-4-turbo, o1, o3-mini or o4-mini, change it to the replacement above and run one test. Then open the task history and look for errors since Friday.
  4. Ask whoever built your website chatbot or quote tool the same question, and put 11 December in your calendar for the gpt-5 and o3 shutdowns.
  5. Write the one-page "what runs us online" list and keep it where the next person can find it.

Sources