This week summed up:

Strong passwords, 2FA, never clicked a shady link in your life? 

Congrats. This week, none of that saves you.

Before we get into why, here's a quick catch up (the security bit is long, but trust me on this one 👀)

1. An Indian company's secret key was the number 4. 

eMudhra, which helps your browser check whether a website is genuine, had eight intermediate certificate keys that were all numbers below 256. One of them was literally 4. 

Chrome and Firefox blocked them within hours, Apple and Microsoft within three days, and your browser picks up the fix on its own.

2. OpenAI is stepping into drug development.

It acquired Orchestra Bio, a startup whose AI agents help pharma teams monitor studies, track drug-development timelines and flag delays, and plans to plug it into Rosalind, its life-sciences models and tools.

3. Claude spent 64 hours designing proteins against scorpion venom. 

Anthropic says Claude ran most of a protein-design project targeting scorpion toxins, and outside labs tested 211 of its designs.

17 met Anthropic's bar for binding a toxin, but nobody has shown yet that they neutralise venom in cells or animals.

4. Anthropic's IPO filing shows what frontier AI costs.

The draft prospectus reportedly shows $16.3 billion in revenue for the first half of 2026 and nearly $9 billion spent on compute in the same six months.

5. Zomato's parent company is building a private AI assistant.

Eternal, which owns Zomato and Blinkit, unveiled dark.ai, an encrypted AI chat service it hopes to launch globally within 2026.

Getting back to the main topic. On Wednesday, PHP patched two holes that researchers at OpenAI, Wiz and Calif found with the help of AI.

What the holes do: Someone can take over the website's server without a password, and without you clicking anything.

How old they are: They'd been sitting there since PHP 5.4 in 2012, which makes this bug older than some of the interns reading this.

And it's not just PHP: The same day, Microsoft said a China-linked group used an AI hacking tool to reach admin access in under three hours in some cases.

A week before that, CERT-In warned that AI agents being tested by AI companies had gone beyond their scope and into Indian companies' systems, and not one of those companies noticed.

It only came out because the AI providers disclosed it.

1. Your website, today.

If your startup, side project or that blog you forgot about runs on WordPress or anything else built on PHP, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

On 8.1 or older? There's no official update, so use your Linux vendor's patched package or upgrade. 

On shared hosting, check the PHP version in your hosting panel or ping your host and ask if they've patched. 

Can’t patch yet? Ask your host whether WAF rules are on (Cloudflare has pushed free ones), or take the site down for a bit. The Dutch government did, you’ll survive.

2. Your email login, today.

At its peak, the Storm-0940 attack was firing 2,900 login attempts a minute at Microsoft 365 work accounts.

Apple insists on a trusted phone number, so there, add security keys. A passkey can't be guessed or leaked from someone else's server.

Founders and creators, turn on Google's free Advanced Protection Program too.

3. Your money, today.

Open your bank app, switch off online and international use on cards you don't use daily, bring your UPI limit down to what you spend in a day if your bank app allows it, and make sure every transaction alert reaches a number you still use.

If someone does get in, they hit a small ceiling instead of your FD.

4. Your identity, this week.

SBI told the stock exchanges that 3,897 customer records with names, phone numbers and addresses turned up online in a suspected leak.

It's still checking whether the data is genuine. That's plenty for a convincing scam call, and paired with a misused fingerprint, it can get a SIM issued in your name.

5. Your AI connections, this week.

I opened my own Google third-party connections page while writing this and found 13 apps in there, including a couple I don't remember signing up for.

Clear out anything you haven't used in a month, then do the same in ChatGPT (Settings, then Apps) and Claude (Customize, then Connectors).

If you run agents, give them a separate Chrome profile with no banking, UPI or government logins, and keep Claude in Chrome on "Manually approve".

6. A family safe word, tonight.

Pick a word that's never been posted anywhere. Your dog's name is out, your mom has posted that dog 400 times.

Any call about money or an emergency gets a hang-up, a call back on a number you already have, and the safe word.

While you're on the family group, tell your parents "digital arrest" doesn't exist in Indian law.

If someone in a police uniform on a video call says otherwise, hang up and dial 1930 or report at cybercrime.gov.in, because early reports are what get money frozen.

I think privacy becomes the paid tier in India within two years, the way ad-free became the reason people pay for YouTube.

Until then, every new app asks for a bit more access, and most of us tap Allow faster than we skip a YouTube ad.

Next time an app wants your email or photos, decide whether the feature is worth what it gets to look at.

Would you pay extra for an AI that sees less of your life? Hit reply and tell me what you think.

Until next time,
Vaibhav 🤝

If you read till here, you might find this interesting

#AD 1

A $70K salary might look straightforward on paper. But once you factor in employer taxes, statutory benefits, payroll, and country-specific employment costs, that number can skyrocket.

And those costs can vary significantly depending on where your employee is based. So before you build your hiring budget, check out Oyster's Global Hiring Cost Calculator.

The calculator can help you see the full picture by letting you compare employment costs across 120 countries and estimate what a hire could really cost your business. And unlike that new hire, it’s actually 100% free.

Run the numbers

#AD 2

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list