An AI model found two holes in PHP, the language that quietly runs a huge share of the web, and very likely your shop's website too. The patches shipped on Wednesday. Attackers were already knocking before the official announcement. If you sell on a WordPress or WooCommerce site, this is the one story today you actually need to act on.
The rest of the day's news points the same way, just slower: big retailers are opening their stores to AI shopping agents, and one platform switched that on for its merchants by default. Let's go.
AI found a flaw in the code under millions of shops
On October 21, the PHP project released emergency fixes for two critical bugs, nicknamed PHP2Shell. They let an attacker run their own code on a server with a single request, no login needed. The flaw sits in PHP itself, not in a plugin, so it hits almost any setup that serves web pages with PHP.
The twist: the bugs were found with AI. A security researcher used one of OpenAI's models during an audit of PHP's source code that OpenAI paid for. OpenAI says frontier AI found these holes before attackers did. Good news, sort of. The bad news is that attack attempts started before the public disclosure, and Cloudflare reported tens of thousands of attempts within 45 minutes of the news spreading. Some sites were briefly taken offline just to patch.
Why it matters to you: WordPress and WooCommerce run on PHP. So do many hosted shop builders. You don't need to understand the bug. You need to send one message to whoever runs your hosting:
- Ask: "Is our PHP updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or patched by our vendor)?"
- If you're on PHP 8.1 or older, ask what the plan is. Those versions no longer get normal updates.
- If your site sits behind Cloudflare, it already has some protective rules, but that is a seatbelt, not a fix.
And the bigger lesson: AI now finds bugs faster than people do, for defenders and attackers alike. "We'll update later" just got a lot more expensive. If you added a chat widget or other extras to your site, our guide on adding an AI chatbot to WordPress is a good reminder of what's running on your server.
Walmart lets AI agents shop. Amazon still says no.
Walmart unveiled Agent Gateway this week, a door that lets approved AI assistants search its stock, check what's available right now and complete purchases for a shopper. Meta's Muse, ChatGPT and Gemini are named as supported agents. Next month Walmart adds "Agent Profiles": per-agent spending limits, approval for every purchase if you want it, and a button to cut an agent off at any time.
Amazon went the other way. It has been blocking Meta's Muse agent from browsing and buying on its site since September 20. So the two biggest retailers in the US now hold opposite bets on the same question: should a customer's AI be allowed to walk in and buy?
Why it matters to you: you aren't Walmart, but you'll face the small version of this choice. More customers will arrive through an assistant that asks "do you have this in size 38, and can it ship by Friday?" and expects a fast, exact answer. Shops that answer clearly get the sale. Shops that answer "DM us for the price" get skipped. We covered the rules being written for these agents in our digest on Meta and the shopping-agent standard.
One platform turned AI shoppers on for its merchants
Commerce.com, the company behind BigCommerce, partnered with Cloudflare so that AI agents running in a shopper's browser can search products, compare options and fill a cart on BigCommerce stores. It uses a new web standard called WebMCP, which lets a site tell an agent what it sells and what it can do. Merchants need no setup.
The detail worth noticing: it is on by default for eligible merchants. You can switch it off in a new settings menu. Checkout still happens on the merchant's own storefront; the agent just hands the shopper a link.
Why it matters to you: this is what the next year looks like. Platforms will make your store "agent-readable" whether you asked or not. That's fine if your product pages are honest and complete: sizes, colors, stock, delivery times, return rules. If half of that lives only in your head or your DMs, the agent sees a thin page and moves on. A clean catalog is now a sales tool, not admin work. Our piece on what a website chatbot needs to actually sell lists the same basics.
Quick takes
- Target stays inside ChatGPT for the holidays. Its full storefront in ChatGPT, where shoppers describe an occasion and buy in one checkout, is running for a second holiday season. Salesforce expects about one in three online stores to have a personal shopping agent by Cyber Week.
- "Sign in with ChatGPT" goes on tour. At an OpenAI developer event in Seoul on October 22, the company pitched letting apps run on a user's paid ChatGPT plan instead of the developer paying for every AI call. Cheaper AI apps for your customers, and more of them, are coming.
- Instagram's Edits app gets a desktop version. Meta added an AI assistant that suggests content ideas based on how your posts perform. Instagram also lets you swap the music on published posts without losing likes or comments.
- Gemini gets a settings hub. Google is rolling out a single "Customize" page in Gemini for skills, prompt preferences and connected apps. Small, but handy if you use it for captions.
What this week means for your shop
Two threads, one theme. AI is getting very good at reading systems: finding bugs in code, reading stock levels, filling carts. Your job is to make sure what it reads about you is safe and true. Patch the server today. Then tidy the product info, because customers and their agents will expect an answer in seconds, not tomorrow morning.
That second part is exactly where Vardast helps: it answers your customers on Instagram, WhatsApp, Telegram and your website, around the clock, using your real products and prices, so nobody leaves because the shop was asleep.