Viewson

Microsoft offered buyouts to 60,000 people. Your team noticed. Book 20 minutes with each person this week and tell them what AI changes about their role. Source: BNN Bloomberg (AFP), Oct 26 Book a call: viewson.com/calendar #FractionalCTO #FounderTips #StartupLeadership #BusinessStrategy

2 years. That's how long a pair of critical PHP bugs sat unpatched. Now CISA says hackers are using them, and PHP reportedly runs 70% of web-facing servers. This week, ask your web host which PHP version your site's on and if it's patched. Source: TechCrunch, Oct 27

OpenAI's new AI can type your invoices into your books. On OpenAI's own trick-prompt test, it still gets 16.7% wrong at low effort. Before you switch it on, name 1 person who checks its entries every week. Source: OpenAI, Oct 26

Meta plans to raise $95B for AI. Its own release says "high-margin" twice, both times about selling AI services to businesses. Nobody's promising today's AI prices will hold. Ask for a 12-month price lock before your next renewal. Source: Meta via PR Newswire, Oct 26

31% of breaches now start by exploiting a software flaw. Stolen passwords start 13%. This Cybersecurity Awareness Month, the advice about passwords, MFA, and phishing is good for your team. The owner's job is different: write down what you run, who owns it, and who has access. You can't patch what you never listed. The fix takes 10 minutes and a spreadsheet. Read the full issue: CTO on Call LinkedIn Newsletter, link in bio Book a call: viewson.com/calendar Which part of your business has no named owner? #CybersecurityAwarenessMonth #FractionalCTO #AssetInventory #SmallBusinessSecurity #TechLeadership

Docs everyone assumed were still true. youtu.be/TK9pv88s2oE?si=6Oxk… via @YouTube

CTO on Call Vendor Ownership youtu.be/4jVaiF1r8oY?si=Q0di… via @YouTube

Q4 budget meetings are coming. The default move is to take last year's total and add 10%. That locks in whatever waste was already there. Teams that audit first recover $6,800 in year one. Check renewal dates before you add the 10%.

Your technology budget problem probably isn't the total. SMB tech spend is up 7% this year and most companies aren't overspending overall. They're spending on the wrong quarter of their own stack and have never checked which quarter that is.

27% of the average small business's software budget is wasted. Not one bad purchase, 28 separate subscriptions that each looked fine on their own. The average team runs 28 tools now, up from 19 three years ago. Nobody's checking back in on any of them.

Here's something I keep having to say to clients: patching the vulnerability everyone heard about doesn't mean you patched the one that matters. N-able fixed an authentication bypass this spring. Attackers found a different way through the same door, and CISA confirmed active exploitation of that second path starting August 1. The businesses getting hit right now aren't the ones who skipped the patch. They're the ones who patched once and stopped checking. The pattern showed up twice more this week: an AI workflow tool with a superuser back door, and a browser extension that can forge a click into your inbox. None of it required the victim to do anything wrong. I write about one of these gaps every Friday. If this one landed, the next one probably will too.

Every AI tool and browser extension your team approved this year still has whatever access you gave it, including the ones everyone forgot about. Open your Google Workspace or Microsoft 365 admin center. Find the list of connected apps with access to email, files, or calendar. Revoke anything you don't recognize or haven't used in 90 days. Narrow the scope on anything you keep. Takes 10 minutes. Costs nothing. Removes one way a hijacked extension or forgotten vendor tool gets to your real data. Drop a comment with what you find, or message me if you want the full breakdown behind this.

Someone's Gmail, Google Docs, and Calendar got read out by a tool they never approved. They'd installed one browser extension to save five minutes. Turns out that's all it took. Researchers found Claude's Chrome extension never checks whether a click asking it to read email came from a real person or a script running in the background. Any other extension on the same browser can fake that click in about six lines of code. Researchers flagged this in May. It still worked in the version released July 7. This isn't a story about one company's mistake. It's a story about what happens when AI tools get standing access to your inbox before the permission model catches up. Ask this: when you approved an AI browser extension, did you check what else is installed on that same browser?

FCTO Wire July 28 youtu.be/mhX1rUGHLSA?si=3MSX… via @YouTube