This week the PHP Foundation disclosed two critical vulnerabilities in PHP, the scripting language behind a large share of the web, including WordPress, Drupal, and Magento. According to WIRED, the flaws affect every PHP installation serving web requests going back to version 5, released in 2004, and can allow attackers to run code on a server or read sensitive memory that may contain passwords and API keys. Patches are available for PHP 8.2 and newer, and the foundation was blunt in its advisory: “There are no complete mitigations, updating is the only safe choice.” Attacks began before the fixes were released, and several government websites went offline as a precaution.
HubSpot customers were not affected. HubSpot posted an update to its Trust Center confirming that PHP is not part of its infrastructure and that it is not aware of any impact to its platform or customers. Dharmesh Shah, HubSpot’s co-founder and CTO, added on LinkedIn that the company doesn’t use PHP in its CMS or core CRM applications.
What I want to key in on is the platform’s dedication to security and transparency. HubSpot maintains a formal security program with annual third-party audits, penetration testing, and a defined vulnerability management process, and every site on Content Hub is protected by a web application firewall, DDoS defenses, and automatic SSL. Updates happen at the platform level, so nobody on your team is scrambling to deploy patches at all hours of the day and night.
-Sage Levene, VP of Marketing, Hypha HubSpot Development
Open Mic
Zero Errors Isn’t the Goal
By John Patti, Senior Web Designer
There’s a really satisfying moment during an accessibility audit when the error count finally drops to zero. It feels like the work is done, and it’s tempting to call it there and move on to the next thing.
The problem is that automated tools like axe only catch some of the issues. They’re good at finding things like missing alt text, low contrast, or a button with no label, but they can’t tell you if the page actually makes sense to the person using it. I’ve seen alt text that just says “image-(1).” I’ve seen carousels that technically work with a keyboard but take a long time to get through. Both of those can pass a scan without any problem.
For me, the most useful test is using the site the way someone else would. I’ll put the mouse away and try to get through a page using only the keyboard to see if I can tell where I am and if things happen in a logical order. Sometimes I’ll turn on a screen reader to hear how a page is read out loud, or turn on reduced motion on my computer to make sure an animation actually stops. It only takes a few minutes.
This is something I think about a lot with HubSpot, since clients can build and edit pages on their own. That also means a site that was accessible on day one can slowly slip as new modules and images get added. That’s why I try to build some of it right into the modules.
The audit is a great starting point, but it shouldn’t be the last step.
Originally, Meta announced that in its Oct. 30 terms of use update, it could “use web scrapers to crawl and collect content from websites ‘associated with’ business accounts on its platform.”
There was no way to opt out of it, and though its own developer documentation explains how to block Meta crawlers using robots.txt, it seemed that wouldn’t be sufficient to avoid being crawled.
“Now, without any notice, Meta has pushed back the date of the change by three weeks to Friday, November 20. The delay comes one day after a major trade group for news publishers sent a letter to CEO Mark Zuckerberg demanding that the forthcoming terms be withdrawn.
“Despite the delayed date, the controversial language in the updated terms appeared to still be intact as of Friday.”
Just a fun little feature and a clear, natural extension of the platform.
“As explained by LinkedIn: ‘You can now design and personalize your LinkedIn business card to express who you are professionally, add it to your digital wallet, and easily stay connected with people you meet in person. Rolling out globally over the coming months.’”
“As shown in this image, posted by Entrepreneur Magazine Editor-in-Chief Jason Fiefer, who at LinkedIn’s ‘Connection by Design’ showcase event last week, the new LinkedIn digital business cards will include a headshot and job role description from a users’ LinkedIn profile, plus a QR code.”
Hypha Highlights
HubSpot for manufacturing works best when the CRM reflects how sales, estimating, and production work together. It can keep customer relationships, quotes, and follow-up organized, but the setup needs to account for what estimating requires before preparing a quote, who follows up with the buyer, and what production receives when the sale closes.
That’s the principle behind our work connecting manufacturing websites, CRMs, and operational systems. Each team should be able to pick up the work with the information it needs.
Getting there means deciding what belongs in the CRM, which requirements matter at each stage, and how to introduce the system without disrupting active sales. ERP integration becomes part of that plan when sales needs operational data to do its job.
Anthropic made a run of moves spanning finances, products, policy, and philanthropy as it prepares for a mega-IPO that could value it at up to $2 trillion. A draft prospectus viewed by the WSJ showed revenue surging to $16.3 billion in the first half of 2026 (up from $1.1 billion a year earlier) against a net loss of more than $80 billion. On products, it launched Claude Duet, a “proactive agent” in research preview that runs in the background and surfaces tasks, its answer to Meta’s Muse and OpenAI’s Dots. On policy, Anthropic quietly circulated a draft federal AI safety bill that would let the government block a model only if it poses an imminent risk of over $1 billion in damages or 50-plus deaths and would preempt some state laws—criticized by safety advocates as weaker than the rival FRONTIER Act. And it committed a portion of its shares to a new Anthropic Public Benefit Fund, bringing roughly 20% of its equity dedicated to the public good.
The Wharton School’s fourth annual report on enterprise AI finds that while adoption is now near-universal—62% of organizations use AI daily and 73% report significantly changed workflows—only 7% succeed across all three markers of success the report identifies: proving value, transforming workflows, and aligning the organization around AI. A key flaw is how companies measure returns: most track ROI by hours saved rather than growth, yet departments tracking at least one growth measure report strongly positive returns far more often (35%) than those tracking efficiency alone (13%).
Inception Labs released Mercury 3 on October 19, a diffusion-based model that generates tokens in parallel rather than sequentially—4-8x faster than comparable frontier models. The company says the model outperforms GPT-6 Luna and Claude Haiku 5.5 on some benchmarks, though all performance claims are vendor-reported, and positions it as undercutting the “fast-cheap” tier that smaller models like Haiku and GPT-6 Luna have occupied.
A Pew Research Center analysis finds that while the gender gap in overall AI chatbot use has closed—men and women are now equally likely to say they use tools like ChatGPT—differences persist in how each group uses and views the technology. Men report using chatbots more regularly and for a wider range of purposes including work and search, express more confidence and familiarity with AI, and are more likely to find it helpful for productivity, while women are more skeptical: they are about twice as likely to expect AI will harm them personally over the next 20 years and more likely to say the technology is advancing too quickly.
Cover to Cover
The titles team Hypha can’t get enough of.
Excited to read this one when it comes out in Februray!
“Timnit Gebru has been present at nearly every inflection point in tech’s recent history. She was an engineer at Apple on the cusp of the iPhone’s first release, a PhD student at Stanford’s computer vision lab as her advisor worked on the enormous datasets so crucial to AI’s development, and the most senior Black woman on the Ethical AI team at Google as DeepMind and Open AI took over the field of artificial intelligence—where she was forced out for having raised the alarm about bias in large language models, causing global shockwaves in the tech industry.
“Part memoir and part manifesto, Deep Unlearning is as much about ideology as it is about technology—and about how to guarantee justice in both.”
How can we help you?
Case Study: HubSpot Content Hub Build
A family-run manufacturer selling a fence accessory had grown two distinct audiences—commercial buyers like schools and parks, plus homeowners who found them through social media. The site hadn’t kept up with either. It had a Squarespace splash page forcing a choice before visitors saw anything, and product specs locked in PDFs.
We replaced the splash page with a header toggle on a real homepage—visitors land on content, pick their path at the top, and switch without backing out. Specs and pricing moved into page flow. FAQs distributed to relevant pages. Before-and-after slider, selectable card forms with fence icons, and calls to action throughout the commercial experience. Mobile details handled: tappable contact info, shipping lead times in a persistent announcement bar, footer leading with phone and email.
The site now runs HubSpot tracking, Google Analytics, Google Tag Manager, and Hotjar. Early heat maps gave both teams a starting point for the next phase.
Site serving two audiences, or product details still locked in PDFs? Contact Hypha to plan the build.
