The week’s lesson is that the work you do not write down is where things break. A PHP patch may be waiting on your website, a platform rewrote its business terms, and two benchmarks show agents missing the constraint a client never stated. For a solo operator, the fix in each case is the same: know what you depend on, and write down what you expect.
A PHP security patch that may touch your website
On October 21 the PHP project released fixes for two remote code execution flaws. Simon Willison’s summary says the fixes cover the entire PHP 8.x line and that exploits were already circulating, because details leaked before the release. Latent Space’s recap reports that researchers demonstrated attacks without a login against WordPress, Drupal and Joomla. That demonstration is researcher-reported and I have not verified it. The same recap says security researchers found the flaws using OpenAI models.
What this means for you: if your site, shop or booking page runs on WordPress or a similar system, you rent a server that runs PHP, and someone has to update it. Ask your host or developer this week whether PHP has been patched, and get the answer in writing. You do not need to understand the bug to ask that question.
Meta changes the word in its business terms
Ars Technica reports that Meta dropped the word “train” from its commercial terms of service, which take effect October 30. The change followed backlash after legal experts warned the terms seemed to let Meta scrape websites linked from business pages. I have only the article’s summary, and removing one word is not the same as changing what the terms allow.
If you advertise or sell through Meta’s business tools, read the new terms before the 30th. This is The Data Boundary in practice: decide what you may put in front of a platform, including links to your own pages, before you cross a line you owe to your customers.
ChatGPT Ads expands again
OpenAI says ChatGPT Ads is expanding to 26 new countries and that over 100,000 advertisers have used the platform. This is an expansion of an existing program, not a launch, and I have only OpenAI’s summary of the announcement. If your customers use ChatGPT to compare and decide what to buy, paid placements will sit next to the answers they get.
The business consequence is about ownership. A channel you rent can change how it ranks you for a fee. An email list and a site you own do not.
Two benchmarks on handing AI the client work
FDE-Gym (273 upvotes on Hugging Face Daily Papers) tests agents on 95 customer delivery tasks, where the brief is vague and the system is live. Across 13 model configurations the best averaged 0.56 and resolved 14 of 95 tasks. The authors name the main bottleneck: discovering unstated constraints. OR-License (300 upvotes) uses 31 instances from paid operations-research engagements worth USD 3.68 million. The best configuration, Claude Code, reached 88.39% strict feasibility and a deployment-adjusted quality of 0.87 against an expert’s 1.
Read those as a limit, not a verdict. Agents are close on well-specified work and weak on what nobody said. That is The Intent-Execution Gap: the instruction you wrote and the result you meant are different, and the difference is yours to close. Before you hand a client job to an agent, list the three things the client would call obvious. Those are the constraints it will miss. This is also why The Specification Sovereignty Framework puts your value in the brief and the acceptance test.
Paying for output, not hours
On Latent Space, Tenex describes paying its AI engineers for delivered work rather than hours at a keyboard, because an hourly rate pays an engineer less when AI makes them faster. They also report roughly 2x output per engineer over the past year, which is their own estimate. If you sell your time, the same arithmetic applies to you: AI shortens the hours, so a price tied to hours shrinks with it. Price the result.
The throughline
Each item turns on something that is easy to leave unowned: the patch nobody is assigned, the terms nobody read, the constraint the client never wrote down. A stateless tool that you rent will not remember any of it. A system you keep, with a checklist that grows each time something slips, gets better every week. That is the thesis in marketing-grade decays, engineering-grade compounds.
If you want the practical version, start at curiochat.ai/solopreneur/.