Nick Watson

Founder, C4C Group. Independent tech advice for UK orgs: renewals, security, AI that works. Also building Page Forge and Get You In. Sussex.

[Nick Watson @iNickWatson]

A biology graduate reportedly sent 500+ applications and was turned down by a Whole Foods chatbot.

Automation should remove the waiting, not the human. It's the rule I use building Get You In: let software take the booking, never the relationship.

[Nick Watson @iNickWatson]

The Guardian says Meta, Microsoft and others are reining in workplace AI because fixing its output eats the time it saved.

That's not AI failing. That's AI rolled out before anyone asked which jobs it should do.

Start with that question: https://t.co/szC7qFpXCJ

[Nick Watson @iNickWatson]

An 11-year-old flaw in the Linux kernel. Reports say an AI model built a working exploit for it in 53 minutes.

Most patch windows are still measured in weeks. That gap is now the whole story in security.

Patch and reboot today. Then ask how long the next one would take you.

[Nick Watson @iNickWatson]

Most of the breaches boards end up discussing start with people and devices, not exotic code.

If you want a quick read on where yours sits, this free check takes a few minutes: https://t.co/xIsNmXVJCZ

[Nick Watson @iNickWatson]

The biggest crypto heist on record reportedly started with one laptop.

Binance says around $6.3bn left its wallets after a DevOps engineer's machine was compromised. Not a clever contract bug. Not a quantum attack. A laptop.

Your organisation has hundreds of those.

[Nick Watson @iNickWatson]

Three questions worth asking on Monday:

Which laptops can reach production or payments?
Would anyone notice one acting oddly at 3am?
Can a single login move money, or does it need a second human?

[Nick Watson @iNickWatson]

It's not just homes. Lift phones, alarm lines, card terminals and care alarms still sit on copper in plenty of UK organisations. Copper goes at the end of January. If nobody has audited what's still plugged into those lines, this week is a good week to start.

[Deeploomatic @Deeploomatic]

🚨🇬🇧 UK | MPs: LANDLINE SWITCH-OFF COULD CUT ELDERLY OFF IN EMERGENCIES

Copper lines go by end of January. Digital lines fail in a power cut; backup batteries may last only an hour.

MPs warned remote areas could be left unable to call for help.

Source: BBC News

[Nick Watson @iNickWatson]

vSphere Express is doing the rounds in reseller briefings: fixed 128 cores, one year, reported to replace Standard and Enterprise Plus. Broadcom hasn't announced it. Before you sign, know your real core count and what Standard would cost on the same day.
https://t.co/SaTn3VYjaA

[Nick Watson @iNickWatson]

Both big AI labs now show up by name in Chrome's security credits. Great for defenders. But if a model can find the bug in days, so can the next attacker's. Patch cycles measured in weeks won't survive that. Automatic browser and endpoint updates first, debate later.

[Sughu @sughanthans1]

interesting detail in chrome's latest update: of 52 security fixes, 6 are credited to anthropic's xinyang ge "assisted by claude", including 2 of the 4 critical ones. 4 more are credited to "openai codex security".

so both labs' models now show up by name in chrome's security credits.

anthropic says 62 cves (common vulnerabilities and exposures) that claude found are now patched as of chrome 156, all rated critical or high.

[Nick Watson @iNickWatson]

@CoinbaseSupport @zubic_eth Fair distinction for your systems. For customers it lands the same way: real names and emails are out there, so the next wave is convincing phishing.

Worth a clear, pinned warning on what you will and won't ever ask them to do.

[Nick Watson @iNickWatson]

Peter Thiel reckons the human edge in the AI era is relationships. Golf with clients included.

As someone who sells independent advice and would rather talk on a tee than on a Teams call, I feel professionally vindicated.

AI can draft the proposal. It can't earn the trust.

[kuldeep @ku1deep]

I was listening to The Builders podcast where Walter Isaacson is interviewing Peter Thiel. Walter asks him what is the unique human edge in this era of AI. Peter goes silent for a whole 30seconds. I kid you not a whole 30s and then provides a very heartfelt answer which essentially boils down to "Human relationships". The whole podcast is worth listening to. Twice. I recommend you subscribe to that channel as well.

Youtube link : https://t.co/sgsMtvy1C5

[Nick Watson @iNickWatson]

PHP runs a huge slice of the web. Two flaws that let attackers take over servers without logging in are being exploited now, and CISA has told US agencies to patch by tomorrow.

The fix shipped a week ago. The gap between patch released and patch applied is where breaches live.

[Nick Watson @iNickWatson]

We built a free, independent check for exactly that question. No pitch, just where you stand:

https://t.co/tHguLpBSjk

[Nick Watson @iNickWatson]

A Japanese hosting firm said no to a $50m ransom. The hackers now leak its data daily, and Japan's Prime Minister called an emergency cabinet meeting.

Refusing to pay is the right call. But it's only a strategy if you can recover without them.

[Nick Watson @iNickWatson]

The test is simple. Could you rebuild from backups the attacker couldn't touch? And have you actually tried it this year?

If the honest answer is "probably", that's your gap.

[Nick Watson @iNickWatson]

Coinbase says it wasn't breached. Its analytics vendor was.

To the customer whose email leaked, that's a distinction without a difference.

Your attack surface is every supplier you've handed data to. Most organisations couldn't list them by Friday.

https://t.co/9lzoOcdWd2

[Nick Watson @iNickWatson]

This is the bit boards should sit with.

Not "AI will hack us." AI made decade-old flaws practical to find and exploit at scale. Patching culture was already late. Now it is visibly too slow.

Basic hygiene and human risk still matter more than another shiny detector.

[Yasshoozer Joshua @_yjoshua]

70% of websites run on PHP.

On October 21, two flaws in PHP scored 9.2 out of 10 each.

Unauthenticated remote code execution.

No login. No password. Run code on the server.

That is PHP2Shell, CVE-2026-109618 and CVE-2026-109619.

The detail worth sitting with:

Black October was not one attack.

It was eleven major failures in one October week, and nobody coordinated them.

That is worse, in a way.

A single villain you can blame, block, and brief against.

Eleven unrelated breaks means the system itself frayed.

Here is the cluster, in one breath:

PHP, the language behind about 70% of websites, cracked.

eMudhra, a certificate authority, had 8 intermediate keys so weak one was literally 4. About 30,000 certificates now need replacing.

Microsoft tied Storm-0940 to a ConnectWise supply chain compromise reaching 2,250+ cloud tenants, using ARTEX, an AI pentesting framework. Some victims went from first contact to privileged cloud access within 3 hours.

LiteLLM shipped a poisoned release that stole credentials. Stolen AWS credentials were tested about 4.5 hours after they were taken.

Governments in the Netherlands, Finland, and France took their own sites offline rather than leave them exposed. Wikipedia and the Internet Archive briefly went dark on October 21 too.

They were not hacked in that moment. They chose to go dark.

The timeline is the scary part:

Amazon spotted an exploit attempt on October 17, four days before the patch existed.

Cloudflare saw thousands of attempts in the 10 hours before disclosure.

Tens of thousands within 45 minutes after.

Hundreds of thousands within 2 hours.

Millions by the next evening.

AI found these flaws. Calif found one on August 1 using OpenAI's GPT-5.6 Sol. Wiz found them using Google's Gemini 4 Argon and Sol.

The bugs had sat in PHP for more than a decade. Humans could not practically crack them. AI could.

Not a smarter hacker. A faster finder.

Sam Altman said it plainly: I no longer think we are going to be able to patch all the bugs.

Anthropic's deputy CISO Jason Clinton called it a vulnerability tsunami, and said there will not be enough time to patch critical infrastructure.

The lesson is not patch faster, though patching matters.

Patching stops the next break-in. It tells you nothing about who already walked in before the patch.

What broke this week, the patch window or the idea that patching alone is enough?

Share this with someone who still thinks one update closes the case.