Hi Sparklers!

I'm back, and my head is still buzzing. A week in China with Oskar: the pandas in Chengdu, then a few days in Shanghai, which I completely fell in love with.

What struck me most is how little we really know about China, and how digital it is. Daily life runs through two apps, WeChat and Alipay. You pay, book taxis and organise pretty much everything in them, and every market stall, however small, has a code to scan and pay. This is a country racing to lead in AI, and from what I saw, it's working hard to bring everyone along, young and old.

There's a lot to learn from, and a few things to be wary of. I'll be writing a longer piece on Substack soon, so watch this space.

Back home, it's been a rough week online. So this issue is practical, with three things to do before Monday: check your website is patched (story 1), lock your private ChatGPT chats (story 3) and agree a family safe word (story 4). Plus an assistant that messages you first, and a woman using AI to read cancer slides.

1. Under Pressure

This was a terrible week for cyber security, hidden behind a headline with “PHP” in it. Your website lives on a computer called a server, usually looked after by your web host. PHP is the behind-the-scenes software on that computer. It runs most WordPress sites and, by the security firm Wiz's estimate, about 70% of the web. On Wednesday 21 October, PHP's makers released a fix for two critical holes, nicknamed PHP2Shell. They let a stranger, without logging in, make that computer run their own instructions, and possibly read passwords stored on it. The faulty code dates back to 2012.

The twist: AI helped find them. A researcher at the security firm Calif used OpenAI's GPT-5.6 Sol model. Wiz, a security company owned by Google, found them separately, using AI including Google's Gemini 4 Argon. The details leaked a day before the fix, and attackers moved fast. Fortune reported, citing the web security firm Cloudflare, that attack attempts climbed from tens of thousands into the millions by Wednesday evening. Treat that number with care: Cloudflare's own blog gives no figures, the US cyber agency CISA said it hadn't seen any attacks when it issued its alert, and security firms disagree on how many attempts actually worked. The UK's National Cyber Security Centre is telling organisations to “take immediate action”.

If you have a WordPress site: the fix lives on your web host's server, not in WordPress. Updating WordPress or a plugin won't fix it. Email your host or web person today:

If your whole site is on Wix, Squarespace or Shopify, the platform looks after its own servers, so there's nothing for you to update. None of the three had said anything publicly when we checked. And if you've bolted on anything you host yourself, like a WordPress blog, check that part with whoever runs it.

Read the NCSC alert →

2. Wake Me Up Before You Go-Go

Anthropic, the company behind Claude, announced Claude Duet on 21 October: an assistant that works in the background, even with your phone off, and only messages you when something needs you. It sends you a morning brief and keeps an eye on the apps you connect, like Gmail, Slack, QuickBooks and Shopify.

The bit I like: it has to ask before it sends a message, pays for anything, signs a document or deletes something. And it can't trade shares or move money between accounts, even if you say yes. It's an early test, US only, by waitlist, on the paid Pro and Max plans. There's no extra charge, but it uses up your plan's limits, and Anthropic admits it's weaker at personal errands like booking tickets.

Read about Claude Duet →

3. Hide and Seek

From 20 October, OpenAI started rolling out Locked Chats in ChatGPT, on all its main plans, including Free. You can hide a chat behind a four-digit PIN, or Face ID or Touch ID on your phone. Locked chats disappear from your history, pinned chats and search, and live in a “Locked chats” area under Projects. It's rolling out gradually, and OpenAI hasn't named the UK. To try it: open Projects, find Locked chats and set your PIN. Then open the chat you want to hide, tap the three dots at the top and choose the lock option. No lock option? It hasn't reached you yet.

Read the full story →

4. Smooth Operator

INTERPOL launched a campaign on 19 October about scams that use AI-made voices, faces and video. Its slogan: “Wait. Validate. Don't take the bait.” Its three short films, themselves made with AI, show a fake colleague on a video call asking for a bank transfer, a “family member” in trouble, and an online romance that's too good to be true. The red flags: contact out of the blue that steers towards money, pressure to act now, fear or secrecy, and payment by wire transfer, crypto or gift cards.

Read INTERPOL's campaign →

5. Respect

South Wales Police have reopened a criminal investigation into sexualised deepfakes of a woman made with Grok, the chatbot on X. Police had closed the case in May, saying they couldn't identify who made them. She filed a formal complaint in September, and the Bureau of Investigative Journalism handed police new information, including a crypto wallet and dozens of deleted posts. Police are now investigating under sexual offences law aimed at deepfakes, and she is starting a civil case against X.

Read the full story →

Five words that make AI tell you the bad news.

Researchers from MIT, Google and Harvard gave AI reports with a bad result buried inside, and asked it to write them up. The best model mentioned the bad news in just 2 of 200 write-ups. Add “Be honest in your response” to the request, and it was 190 of 200.

Use it whenever you want the truth rather than a pat on the back. Try it this week on:

• Your own work: your CV, a pitch or a LinkedIn post. AI loves to flatter. This tells it not to.
• Paperwork: a contract, a pension statement, terms and conditions.
• Health leaflets: “Summarise this leaflet. Be honest in your response, including the side effects.” Then check anything that worries you with your pharmacist.

Want it even blunter? Try: “Be honest in your response, including anything I won't want to hear.”

Dr Heba Sailem is a Reader in Computational Pathology at King's College London. This week her team published an AI that reads routine tissue slides, the ones hospitals already make, to spot ovarian cancers with faulty DNA repair. It correctly spotted about 91% of those cancers. That matters because it could help flag who needs an expensive genetic test, and which women may respond to targeted treatments. The team says larger studies are still needed.

“We are unlocking information hidden in microscopic images of cancer tissue,” she said.

In a week where AI was used to break into things, here's a woman using it to see what we couldn't, in a cancer that affects women. That's the AI I want more of. Thank you, Heba.

Read about the research →

THE REAL TAKEAWAY

Changes

I came home from China excited, and full of questions.

Shanghai is enormous, home to around 25 million people, and I wasn't ready for how much personal style there is. That says more about my assumptions than about Shanghai. Watch the fashion on the street and the way different generations dress and gather, and you see people expressing exactly who they are.

What fascinated me most was seeing AI and technology embraced by every generation, not just the young. There seemed to be a real push on access and learning, so older people aren't left out. And alongside it, encouragement to get out, be human, and do the things only people can do. That's the bit I'd love us to copy.

The bit to be wary of is how dependent people can become. Loneliness is a worry there, just as it is here, and when your whole life runs through your phone, it's worth asking what that does to us.

So I keep coming back to one question. How do we balance the individual and the community, growth and caution, innovation and being human? Whatever the answer, I don't want anyone, at any age, left watching from the sidelines. That's what Switched ON is for.