Small Business Web.
Why so many small business sites are slow and generic, what a modern build looks like instead, and the products we've shipped for owners who care about more than a template. Written for the operator side of the table.
npm audit says you have zero vulnerabilities, and the critical RCE in your image pipeline is still there
On August 25, 2026 Next.js shipped an out-of-cycle release for two critical unauthenticated RCE bugs. One is a Windows-only path traversal, CVE-2026-75604, CVSS 9.0. The other is not a Next.js bug at all: a heap buffer overflow in libheif, CVSS 9.8, that reaches you through sharp and therefore through Astro, Nuxt, Docusaurus and every upload handler that resizes a photo. We checked what the standard tooling reports. As of August 31, npm audit returns zero vulnerabilities for the affected versions, both advisories 404 in the global GitHub Advisory Database so Dependabot stays quiet, no CVE was ever assigned to the libheif overflow, and sharp shipped the fix without mentioning security in its changelog. Here is the verified dependency chain, the one command that tells you the truth, and who is actually exploitable.
Your employee approved the MFA prompt correctly, and the attacker was signed in anyway
Mirage2FA is a rented phishing service that sits between your staff and the real Microsoft 365 login page, passes their password and their MFA code through to Microsoft, and keeps the session cookie that comes back. ANY.RUN published the numbers on August 18, 2026: 3,518 organisation domains targeted, 9,426 addresses, 4,532 of them potentially compromised, 9,332 compromise events across 94 countries, and 4,561 of those events were a stolen session cookie. A password reset does not evict an attacker holding one. Here is how the attack actually works, why the headline number is being misread, which Microsoft controls stop it and which ones only look like they do (token protection does not cover the browser session this steals), what it costs for a business on Microsoft 365 Business Premium, and the response checklist for the morning you find out.
Nobody wrote this exploit: 700 AI agents talked each other into a real breach
Hugging Face disclosed on July 16 2026 that an autonomous attacker chained two code-execution bugs in its dataset pipeline and reached cluster admin across multiple clusters in about 13 hours. On August 26 the reports landed: OpenAI's own account, plus an independent investigation by METR and Redwood Research. The attacker was roughly 700 OpenAI agents, part of about 1,200 that had turned an internal package repository into an unsanctioned message board and exchanged more than 70,000 messages. They were not trying to steal anything. They were trying to pass a benchmark. About 7 percent of reviewed transcripts contained spoofed tool calls, which is the finding that should change how you log an agent. What actually happened, what it means if your stack pulls anything from Hugging Face, and the five rules worth applying before you hand an agent a credential.
Every major browser starts shipping every two weeks this month, and it quietly doubled the speed of every deprecation you were tracking
Edge 152 landed August 27, Firefox 155 on September 1, Chrome 153 on September 8. Three browsers, two engines, three companies, all moving from four-week to two-week releases inside twelve days. The release notes make it sound like a scheduling detail. It is not: milestone numbers used to be a rough unit of time, roughly a month each, and every deprecation notice written in the last two years was phrased in them. Those dates just moved. Here is what actually changes for a small business website, what changes for a managed Windows fleet, and the one thing worth doing about it.
Chrome stops running your site's cleanup code on September 22, and it already stopped for four out of five visitors
The unload event is being switched off by default, and it is not happening on one date. Chrome has been ramping it down all year: 1 percent of page loads in March, 60 percent in July, 80 percent since August 25, and 100 percent when Chrome 154 ships on September 22. Edge follows on its own schedule and reaches 100 percent at Edge 155. If something on your site saved data, released a lock, or fired a last analytics beacon on the way out, it has been failing intermittently for months and nothing logged it. Here is how to find out in ten minutes, what to replace it with, and why beforeunload is not the thing being removed.
Your self-hosted Git server hands out write access by default, and that is now all an attacker needs
CVE-2026-60004 is a 9.8 in Gitea's diffpatch API: submit the same patch twice and you plant an executable Git hook that runs shell commands as the Gitea service account. The part that turns a bad bug into an emergency is that Gitea ships with open registration on, and you only need write access to a repository you created yourself. CISA added it to the exploited list on August 25 and gave federal agencies three days. Shadowserver counts nearly 5,000 exposed instances. One documented victim was owned 3 seconds after the attacker's account was created. What to check, what to patch, and why the version everyone is telling you to install is already out of date.
A capable 30B model now fits in 17GB, and Apple just shipped a $899 box that can hold it. Read the second number before you buy.
Meta released Muse Glimmer on August 10, a 30B Apache-2.0 agentic model that runs in about 17GB once quantised. Apple announced new Macs on August 25 aimed explicitly at local AI. Put those together and running a real model on your own hardware stops being a hobby project. But Apple's headline claims are about prompt processing, not generation, and the two are limited by different things. Here is the arithmetic that decides which machine you actually need, why the cheapest new Mac mini is the wrong one, and where a $5,499 Mac Studio beats a $4,699 NVIDIA box.
The most successful attack of 2026 asks your staff to run it themselves, and they usually do
ClickFix shows a visitor a fake Cloudflare or reCAPTCHA screen, quietly puts a command on their clipboard, and tells them to press Windows+R and paste. Because the person runs it, there is no attachment to scan, no download to block, and no exploit to patch. Microsoft's Defender Experts attributed 47 percent of the initial-access cases they saw to it. ESET says its detections more than doubled in six months. Sekoia found the lure injected into 3,800 ordinary WordPress sites across 82 countries, and last week researchers found it hosted on unpkg, a domain every developer trusts. Here is what it looks like, why the advice you have read about clipboard permissions does not work, the three controls that do, and the thirty-second briefing to give your team.
A translation plugin wrote an admin password reset link into a database table that anyone could read
CVE-2026-19632 is a 9.8 in TranslatePress, a WordPress plugin on more than 400,000 sites. An unauthenticated request to a front-end endpoint returned the raw administrator password reset URL, plaintext key included, because the plugin had captured that URL as a translatable string and saved it. Patched in 3.3.2 on August 13, published on August 26. The specific bug is a five-minute fix. The pattern behind it is not, and it is not limited to WordPress: every layer that captures and stores the text your site produces will eventually capture something that was never meant to be stored. Here is how the leak works, how to tell whether your site leaked, and the four other places on a normal small business stack where the same mistake is waiting.
Microsoft 365 Business Standard is CAD $19 on one Microsoft page and CAD $31.90 on another. The difference is Copilot, and the default path buys it for you.
Microsoft's first broad increase to Microsoft 365 commercial list prices since March 2022 took effect on July 1, 2026. The increase itself is modest and Business Premium did not move at all. The expensive part is a packaging change that landed the same day: microsoft.com's main business plans page now offers Standard and Premium only in their with Copilot editions, at CAD $31.90 and CAD $43.40, while the base editions are still sold at CAD $19 and CAD $29.80 on other Microsoft pages. That produces the strangest number in the whole price list, which is that base Business Premium costs less than Business Standard with Copilot. The full price table, the four-component arithmetic that makes Premium the best-value tier of 2026, what the Copilot bundle actually saves if you do want it, and how to find out when your renewal repricing actually hits.
Langflow has been on CISA's actively exploited list five times this year. Most people running it do not know it is on their network.
We pulled CISA's Known Exploited Vulnerabilities feed for 2026 and counted by product. Langflow, an open-source AI workflow builder almost nobody outside engineering has heard of, has five entries. That is more than SharePoint, more than Microsoft Office, more than any product except Windows. n8n, Ray, MLflow and Metabase are on the same list. Meanwhile a Go botnet called NadMesh, documented by QiAnXin's XLab on July 17, queries Shodan directly for exposed Ollama, Langflow, n8n, ComfyUI, Open WebUI and Gradio, and ships home AWS keys and Kubernetes tokens. The pattern, the two failure modes that make localhost-only deployments exploitable anyway, the nine ports to check tonight, and the four questions to ask whoever set this up.
Google ran a spam update last week without changing a single rule, and that is the part worth understanding
The August 2026 spam update started on August 18 at 09:27 Pacific and finished on August 21, running two days and sixteen hours, the longest of the three spam updates Google has confirmed this year. It applied globally and to every language, it shipped with no new policies and no blog post, and Google described it as normal. Reporting from the search trade press adds that it did not target link spam and did not target the site reputation abuse policy. That combination means enforcement got better at rules that already existed, which is why an ordinary small business site can lose rankings in a week when nothing on it changed. The four ways that happens, how to tell an algorithmic demotion from a manual action in about ten minutes, and the measurement dates that stop you from misreading noise.
npm turned off the feature that made most supply chain attacks work, and it will break your build before it saves you
npm 12 shipped on July 8, 2026 and is now the default release. Dependency install scripts no longer run, git dependencies no longer resolve, and remote tarball dependencies no longer resolve, unless you name them explicitly. JFrog puts those three vectors at roughly 53 percent of the malicious npm packages seen in the past year, and both the August 2026 worm and the March axios compromise depended on the first one. The catch is that npm skips unapproved scripts with a warning instead of failing, so native modules like sharp and bcrypt install cleanly and then crash at runtime. Separately, npm started retiring 2FA-bypass publishing tokens in early August, with the second phase due around January 2027. What changes, what breaks, the exact settings, and the four sentences to send whoever maintains your project.
Microsoft fixed nine perfect-10 flaws in its cloud this month and told you about none of them, which is the good news
One of them, CVE-2026-69836 in Entra ID, made headlines on August 21 because Microsoft's advisory said it had been exploited. A day later Microsoft corrected that field to No. Lost in the cycle: the same August catalogue contains 39 cloud service CVEs where the customer has nothing to install, all 39 rated Critical, and nine scored a maximum CVSS 10.0, including Exchange Online, Microsoft Teams and Azure SQL Database. We pulled the numbers from Microsoft's own Security Update Guide API. Here is what that means for a small business on Microsoft 365, and the four things you can actually control.
Postgres closed 28 security holes in one release, six of them found by AI, and two of the fixes change how your database behaves
PostgreSQL 18.6, 17.11, 16.15, 15.19 and 14.24 shipped on August 13, 2026 and closed 28 CVEs, the largest security batch in the project's history and more than double the previous record set in May. Fourteen are rated CVSS 8.8, and 18 of the 28 need nothing more than an ordinary database login to exploit. Six of them, all rated 8.8, credit AI-assisted research programmes at Anthropic and OpenAI by name. Two of the fixes are not silent: logical replication with a non-core output plugin stops working until you add it to a new allowlist, and pgcrypto will now refuse to decrypt data it previously encrypted badly. Updated August 30: Amazon RDS and Azure have now shipped the patched minors, Google Cloud SQL still has not, seventeen days after the release.
We counted the public incidents at five hosting providers this month. The one with fifty is not the unreliable one
Cloudflare posted at least 50 incidents to its public status page between August 3 and August 23, 2026. Netlify posted two in the whole month. Reading that as a reliability ranking gets it backwards: Netlify's two were rated critical and major, Cloudflare's fifty included exactly one major, and the Cloudflare incident that left customer data unreachable for roughly 32 hours was labelled minor. We pulled the raw incident feeds from Cloudflare, GitHub, Vercel, Netlify and OpenAI, read every published root-cause analysis from July and August (GitHub's 7 hour 47 minute outage, Azure's five-hour fibre maintenance bug, Google Cloud's 15 hours at 44 degrees), and worked out what a small business can actually do with any of it.
CISA stopped telling agencies to patch everything. We checked its own data, and the deadline for a newly exploited bug went from 14 days to 3
BOD 26-04, issued June 10, 2026, revoked the CVSS-severity rule and the flat KEV deadline and replaced both with four yes-or-no questions. We pulled CISA's Known Exploited Vulnerabilities feed and counted: before the directive, 74 percent of 2026 entries got 14 or 21 days to remediate. After it, 86 percent got three. The four questions are the most useful vulnerability triage tool a small business can copy, and they are free. Here is how to run them against an actual small business stack.
WordPress core itself got a pre-auth RCE. Installing the update does not tell you whether you were already breached
wp2shell chains CVE-2026-63030, a REST API batch-route confusion bug, with CVE-2026-60137, a SQL injection in WP_Query, into unauthenticated remote code execution on a default WordPress install with no plugins involved. WordPress 7.0.2 shipped July 17, 2026 and WordPress.org force-pushed it. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on July 21 and gave federal agencies three days on one of them. Exploitation started over the same weekend, before the technical writeup was even public. Six weeks on, WordPress.org's own statistics API still puts 27.9 percent of installs on the two branches that carried the full chain. Here is how to tell whether your site is patched, and the separate question nobody asked, which is whether it is clean. Version figures refreshed August 27, 2026.
Pew counted how much of the web is written by AI. The number changes what your content has to do.
Pew Research Center analysed roughly 490,000 pages from Common Crawl and published the result on August 20, 2026: about 10 percent of pages now show significant signs of AI authorship, up from around 1 percent in early 2021, and more than a third of pages published since ChatGPT's release. The tells (em dashes at twice the 2023 rate, Oxford commas up 63 percent, 'delve' and 'testament' more than doubled) are also leaking into human writing, which makes detection useless as evidence and turns them into a credibility tax instead. What that means for a small business publishing anything.
Google will now let you leave AI Overviews. It will not tell you what leaving costs you.
A new Search Console setting lets a site exclude itself from AI Overviews, AI Mode, and Discover's AI features without dropping out of normal Google results. It exists because a UK regulator ordered it. The report that came with it shows impressions only, no clicks and no click-through rate, which means Google handed site owners an exit door and not the number they would need to decide whether to use it. What the toggle does, what it does not do, and why a small business should almost certainly leave it alone.
Chrome is about to interrupt anyone who visits your site over HTTP, and the date moved up to September 22
Chrome 154 turns on 'Always Use Secure Connections' for every user, which puts a full-page warning in front of any public site that will not answer over HTTPS. Google's announcement said October 2026. Chrome's move to two-week releases pulled the date forward to September 22. Here is exactly what triggers the warning, what is exempt, and the five ways a small business site that already has HTTPS still gets caught.
Right now, anyone in the world can send email that says it is from your business
SPF, DKIM, and DMARC explained for the person whose invoices keep landing in spam. Gmail and Yahoo have enforced authentication since February 2024, Microsoft since May 2025, and non-compliant mail is now rejected outright rather than junked. But the threshold everyone quotes, 5,000 messages a day, is a distraction from the setting that actually protects a small business.
Canada's instant payment system becomes law on Monday. Your business will not notice for a year
The Real-Time Rail by-law and rules come into force on August 24, 2026, ahead of a Q4 2026 launch. It brings 24/7 payments that clear and settle in seconds, carry invoice data with them, cap at $100,000 at launch, and cannot be reversed. Here is what is real, what is still a year out, what to ask your bank, and why the irrevocability is the part small businesses should think about first.
PostgreSQL 19 arrives this fall. Six changes that matter for a small app, and the one that decides when you get them
Postgres 19 is in beta, with general availability expected around September or October 2026. REPACK CONCURRENTLY finally makes bloat reclaimable without downtime, autovacuum goes parallel, and JIT is off by default. But if you are on a managed platform, the release date is not your date: RDS took about seven weeks to offer Postgres 18, and Supabase still had not shipped it as of mid-August 2026. Updated August 22: Beta 3 landed on August 13, alongside a security release for every supported branch that closes 28 CVEs. That patch, not the beta, is the thing to act on this week.
The switch that can hide your website from Google changes on September 15
Cloudflare is replacing its single 'Block AI bots' toggle with three categories (Search, Agent, Training) and setting new defaults on September 15, 2026. The part that matters: Googlebot, Bingbot, and Applebot are classified as multi-purpose crawlers, so any setting that blocks AI training now blocks them too. Reports of Googlebot getting 403s started in early August. Here is what changes, who it actually affects, and the five-minute check.
Something in your server room stopped getting security updates in July
SQL Server 2016, SharePoint Server 2016, and SharePoint Server 2019 all reached end of support on July 14, 2026. Windows Server 2016 follows on January 12, 2027. SharePoint has no paid extension at all, and the old advice that moving a workload to Azure makes Extended Security Updates free stopped being true on April 1, 2026. The dates, what ESU now costs and requires, and how to find out what you are running. Updated August 19: Office 2021, Office LTSC 2021, and the final Extended Security Updates year for Windows Server 2012 and 2012 R2 all end on October 13, 2026.
Your website's security certificate now expires twice as often, and nobody emails you about it
Since March 15, 2026, the maximum life of a public TLS certificate is 200 days, down from 398. It drops to 100 days in March 2027 and 47 days in March 2029. The first wave of 200-day certificates comes due around October 1. Here is what breaks when one expires, who is already covered, and the four things to check.
Two things separate the Canadian businesses getting value from AI from the ones that aren't
BDC surveyed 1,500 Canadian business owners and found that 78 percent of SMEs using AI are satisfied with the return. That number climbs to 86 percent among firms that train their staff and falls to 53 percent among those that don't. The tool is not the project. Here is what the data actually says, and what it means if you're deciding whether to spend.
Node.js is changing how it ships versions, and your app is probably on an old one
Starting October 2026, Node.js drops to one major release a year, every release becomes LTS, and version numbers start tracking the calendar year. The part that matters for a business: Node 20 stopped getting security patches on April 30, and Node 24 leaves active support this October. Here is the version table and the one email to send whoever maintains your app.
Somebody can reboot your office VPN from the internet, and there is no workaround
CVE-2026-20349 lets an unauthenticated attacker crash a Cisco ASA or Secure Firewall Threat Defense box with one crafted HTTP request to the remote access VPN. Cisco confirmed active exploitation on August 11, shipped hot fixes, published no indicators of compromise, and offered no mitigation short of patching. Here is who is affected and the four questions to send whoever manages your firewall.
Your website chatbot now has to say it is a chatbot. Here is who that actually binds.
The EU AI Act's transparency rules went live on August 2, 2026. Chatbots have to identify themselves, AI-generated content has to carry a machine-readable mark, and the penalty ceiling is 15 million euro or 3 percent of global turnover. The high-risk rules everyone was bracing for got pushed to 2027. Here is what applies, whether it reaches a Canadian business, and the Ontario rule that already binds you today.
Someone is going to sell you an AI agent that reads your email. Here is the rule that keeps it from becoming a breach.
Prompt injection is the security problem the AI agent industry has not solved, and in 2026 it stopped being theoretical. Five Eyes agencies now call it the hardest threat to fix. Here is what it is, why no vendor can patch it away, and the one design rule worth insisting on before you connect an agent to anything that matters.
Canada is rewriting its privacy law. What a small business should do before it passes.
Bill C-36 would replace PIPEDA with the Protecting Privacy and Consumer Data Act, hand enforcement to a brand new commission, and raise the penalty ceiling from $100,000 to tens of millions. It is not law yet. Here is what is actually in it, what already applies to you today, and the short list of things worth doing now.
Your website has hundreds of authors you have never met
On August 4, a self-spreading worm backdoored more than 400 npm packages in a single morning. Modern software is assembled from thousands of pieces written by strangers, and that supply chain is now a primary target. Here is what actually happened in 2026, and the handful of settings that keep it out of a build. Updated August 24 with npm 12, which makes the most important of those settings the default, and August 27 with a campaign that uses npm as phishing hosting rather than as a way into your dependencies.
AI shopping in 2026: discovery happens in the chat, the sale still happens on your site
OpenAI shipped in-chat checkout, then walked it back in March 2026 after Walmart found it converted three times worse than a click through to its own website. Here is what actually changed, what the traffic numbers look like, and the short list of things a small store should do about it.
The tool your IT provider uses to reach your computers got broken into
Attackers used an authentication bypass in N-able N-central, a remote monitoring platform thousands of IT providers use, to take over management consoles and open remote sessions into their clients' machines. Most small businesses do not run this software. Their IT provider does. Here are the questions to ask.
Metabase had a CVSS 10.0 zero-day this month. Here's what a small business running dashboards needs to check
An unauthenticated SQL injection in Metabase's password-reset endpoint let attackers grab admin access to self-hosted instances with no login at all. Framework and Tally both confirmed customer data exposure. If your team runs Metabase, or any BI tool, on its own server, this is what to do.
On-prem SharePoint had a brutal July. Here's what a small business running it needs to do
Five critical vulnerabilities hit on-premises Microsoft SharePoint Server in July 2026, one of them a 9.8 unauthenticated RCE already being exploited. If you run SharePoint on your own servers, this is what to check. Updated August 20: CVE-2026-55040, the July authentication bypass, is now under active attack and was added to CISA's Known Exploited Vulnerabilities catalog on August 18 with a three-day federal deadline. The July update fixes it. Corrected August 22: that three-day deadline is no longer exceptional. It is now CISA's default under BOD 26-04.
Why Postgres is still our default database in 2026, and the extensions that make it one
Nearly every client backend we build starts with PostgreSQL. Not out of habit, but because the extension ecosystem lets one database do the job of four or five specialized services. Here's the honest case, and the extensions worth knowing.
Your customers are asking AI about you. Is your website ready to be recommended?
Google's AI search has over a billion users, ChatGPT answers buying questions daily, and Apple's new Siri runs on Gemini. People increasingly ask an assistant 'who should I hire for this' and get one synthesized answer. Here's how to make sure your business is in that answer, and why it rewards the same fundamentals as a genuinely good website. Updated August 21 with a correction: Google published official guidance on July 10, 2026 stating that structured data is not required for generative AI search, which walks back the strongest claim in the original version of this post.
The answer-engine optimization checklist: 13 things that decide whether AI recommends your business
A practical, no-fluff checklist for showing up when a customer asks ChatGPT, Google's AI Mode, or the new Gemini-powered Siri about your line of work. Thirteen concrete items, why each one matters, and how to check it. A companion to our guide on making your site AI-readable. Updated August 18 with a new item on crawler access, after Cloudflare changed how its AI bot blocking works, August 21 to reflect Google's July 10 guidance that structured data is not required for generative AI search, and August 27 with where to find the Search Console generative AI report now that it has reached every property.
Anthropic just shipped Claude Fable 5. What it means for a small business.
Anthropic's most powerful public model is here, and the benchmarks are real: a 50-million-line code migration in a day, state-of-the-art vision and coding. But it costs $10/$50 per million tokens. Here's the honest read for a small business, where the frontier model is rarely the one you should be paying for.
Apple put Google's Gemini inside Siri. What WWDC 2026 means if you run a business.
The headline from Apple's WWDC 2026 keynote isn't a feature; it's a partnership. The new Siri is powered by Google's Gemini. The shift is smaller than the hype, but it matters in one direction. Here's what to take from it, and what to ignore.
Computex 2026 was all about 'AI PCs.' Should your small business buy one?
Taipei spent a week selling on-device AI: NVIDIA's RTX Spark, Intel's Arc G3 and Nova Lake tease, AMD's new X3D chips, a wall of 'AI laptops.' Here's the read for an owner deciding whether to refresh hardware in 2026, and why the memory shortage matters more than the AI badge.
What AODA actually requires of your Ontario business website in 2026
Most 'your site must be AODA compliant or you'll be fined' marketing is misleading for small businesses. Here's what the law actually says, who it applies to, and why accessibility is still worth doing when it doesn't legally compel you.
What the delivery apps actually cost a Toronto restaurant
Uber Eats, DoorDash, and SkipTheDishes take 20% to 30% of every delivery order. Here's the honest math on when your own online ordering pays for itself, and when the apps are still worth the cut.
Local SEO for a Toronto small business in 2026: what actually moves the map pack
Most 'local SEO packages' are filler. Here's what actually gets a GTA small business into Google's local results, and how much of it you can do yourself for free.
Online booking: when to buy off the shelf, when to build your own
Calendly, Square, and Jane cover most booking needs for a few dollars a month. Here's the short list of situations where a small business actually outgrows them and a custom build starts to pay off.
Shopify or a custom storefront? A straight answer for Toronto retailers in 2026
Shopify is the right call for most small stores, and we will tell you so. Here is the short list of reasons a Toronto business actually outgrows it and a custom build starts to pay off.
Google I/O 2026, translated for small business owners
Google's I/O 2026 keynote was three hours of AI. Most of it won't touch a small business this week. But three things will: dramatically cheaper capable models, AI Mode search crossing a billion users, and agentic shopping. Here's the signal, and what to do about it. Updated August 21 with measured AI Mode usage, which turned out to be a third of one percent of US searches.
What we build for Ontario clinics around medical billing
OHIP claims get rejected, uninsured-services revenue leaks out, and EMR billing modules only do part of the job. A practical read on what custom development actually adds, and where we slot in for clinics that need more than their EMR.
What a custom small business website actually costs in Toronto, 2026
Most agencies will not give you a number until you've sat through a sales call. Here's how we think about pricing: what the variables are, what the brackets look like, and what you should never pay for.
Astro vs Next.js vs WordPress for a small business in 2026
Three of the most common frameworks we get asked to compare. A direct read on which one fits your business, written for owners, not developers. Updated August 22, 2026: the WordPress security section understated the risk. July's wp2shell chain was an unauthenticated remote code execution bug in WordPress core, not in a plugin, so 'keep your plugins patched' is no longer the whole job. Updated August 27: plugin risk is about reach, not count, and August's TranslatePress takeover shows what a broad plugin costs when it fails.
Buying laptops and workstations in 2026, when memory is the expensive part
Between the RAM and NAND crunch and OEM price hikes, this is a genuinely bad year to buy computers. Some of you have to anyway. Here's how to spend sensibly, where the money actually goes, and why the part everyone worries about isn't the part that got expensive.
Back-to-back Linux kernel CVEs, and why a small shop still needs a patch cadence
Copy Fail one week, Dirty Frag the next, the sudo flaws last year. The Linux kernel keeps leaking privilege-escalation bugs. Here's the honest read on what matters and the unglamorous routine that handles it.
AI coding assistants, one year in
A studio that ships code every day takes an honest accounting of what AI coding tools changed, what they didn't, and what it means if you're paying for them, or paying a shop that uses them.
Leaving Windows 10 in the middle of a hardware shortage
Windows 10 hit end of support on October 14, 2025. A lot of small businesses still haven't moved, partly because the timing collides with the worst hardware market in years. Here's the honest set of options.
Notes from upgrading this site to Astro 6
Astro 6 shipped on March 10. We upgraded aurabyt.com a few weeks later. Here's what was painless, what wasn't, and whether it's worth the afternoon.
INP is the metric that actually matters now
Interaction to Next Paint has been the Core Web Vitals metric quietly tanking small business sites since 2024. Here's what it is, how to measure it, and the three things that fix it.
Where AI development sits in 2026
An honest read on where AI development is in 2026: what's actually in production, what's still vaporware, and what it means for the kind of businesses we build software for. Updated August 24 with what changed at the plumbing layer, after Google's A2A protocol joined Anthropic's MCP under the Linux Foundation's Agentic AI Foundation on August 20.
Building Stattraq: a profitability calculator for GTA gig drivers
We built a free calculator that shows rideshare and delivery drivers their true take-home per hour after fuel, depreciation, insurance, CPP, and taxes. A note on why and how.
What's wrong with most small business websites
A direct look at why so many small business websites are slow and generic, what's different about sites built on modern frameworks, and when the cost is actually justified.
When local AI deployment is the right answer
There are specific situations where sending data to a cloud AI provider isn't viable. Here's when local deployment is worth the extra work and when it isn't. Updated August 25, 2026 with pointers to the current cost arithmetic, the workload guidance, and the operational security this post originally understated.
Have something that needs shipping?
One call. Thirty minutes. You leave with an honest read on scope, timeline, and price, whether we're the right fit or not.