• Nick Woodhead said he went 48 hours without sleep while helping patch a major website vulnerability.
• The CTO said that with security problems piling up, October feels like "the month of hell" for tech.
• Because AI makes it easier to find and exploit security gaps, Woodhead expects more disruption.

This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.

It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.

About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start.

I have some teams offshore, so I was able to jump on that with them.

It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement.

I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.

People are willing to help

One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.

Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.

That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help.

Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.

The month of hell

It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective.

I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.

OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic.

I don't think we're at the end of the road yet. There's going to be a lot more to come.

• Still dreaming of logging on in comfy clothes? Fully remote jobs are getting harder to land.
• Remote roles accounted for 9% of LinkedIn postings in September, yet drew 33% of applications.
• If you want a remote position, be prepared to show you can communicate well and thrive from afar.

When Andie Allan scans job listings, her dog, Luther, is never far from her mind — or her side.

The 92-pound German Shepherd has a spot on the couch in Allan's home office. Allan, a marketing manager who hasn't worked full-time in person in more than a dozen years, is looking for a job that lets her remain fully remote, in part so she can stay close to Luther.

More than six years after the pandemic ushered in a work-from-home revolution, many office workers have gotten used to skipping some commutes and having more flexibility outside their 9-to-5. Others have embraced a return to in-person collaboration.

Entirely remote work remains relatively uncommon: In September, 12.1% of US full-time workers were fully remote, according to Stanford data.

For some, these remote setups are a preference. For others, it can make holding down a job feasible alongside factors like caregiving responsibilities or disabilities.

The search for remote jobs can be tough, however, unless you have an especially in-demand or niche skill set. In the US, fully remote roles made up 9% of job postings on LinkedIn in September, yet drew 33% of applications, the company said.

Competition for those roles has also increased as many companies have returned to the office, at least part-time. The number of applicants per remote job rose 10% from a year earlier, according to LinkedIn.

Candidates seeking these roles might need to show employers they can succeed without regular office time — contrary to what some corporate leaders might prefer. Allan is using her track record of remote work as a selling point when applying. She points to the successful products she launched while working with global teams she rarely met in person.

Allan said she's happy being at home, even if it means forgoing opportunities. Commuting to an office from her home outside London could work, Allan said, "If I was 25 and had no ties and wasn't married to a German Shepherd."

More jobs require in-office time

Access to remote jobs also isn't evenly spread across industries. LinkedIn found that it was most common in technology, information, and media; financial services; and administrative and support services.

Winston Murdock, who's dialed in from home since 2010, works in one of the more remote-friendly corners of the job market as a software team lead. He and his wife bought their house outside Atlanta with an extra bedroom for his dedicated office.

Years ago, Murdock said, a recruiter approached him about a job that would have paid more but required a two-hour round-trip commute on weekdays. Murdock and his wife considered the added costs of childcare, gas, vehicle wear and tear, lunches, and work clothes fancier than a T-shirt.

"There's maybe a number that will get me to choose to be back in the office," Murdock said. "That number was not it."

Murdock said he loves his role at a Canadian software company and plans to stay, in part because of the remote arrangement. He would consider office work only if he lost his job.

How to find fully remote work

For workers looking for a new role, office time is increasingly part of the bargain. Robert Half, the staffing firm, said in a July report that a shift toward in-office work meant "more competition for fully remote roles and a near guarantee that new opportunities will come with at least some in-office time."

The relative scarcity of remote jobs makes a targeted search especially important, said Markos Korvesis, a career coach who helps people find such roles. He said job seekers often don't know how to tailor their résumés to show they are a good fit for logging on from outside an office.

Korvesis spends most of his time in Vietnam and has worked from more than three dozen countries over the last eight years. He recommends that job seekers highlight that they're up to date with AI tools and have solid experience using a variety of communication platforms, from Slack to Discord.

People should point to examples of how they've worked across offices, nations, and cultures, Korvesis said. It's important, he said, to be specific: If you've worked with teams in five time zones, say so.

Korvesis said those details can show that a candidate is prepared to thrive in a remote environment.

The challenges of WFH

Landing a remote job is only one of the difficulties. Chad Albert, who lives in South Florida and helps customize and sell software used in healthcare, said technology has made it easier to collaborate across distances, yet communicating through a screen can make it harder to connect with colleagues.

Albert said he makes an effort to pay attention when coworkers talk about their hobbies or what they did over the weekend.

The goal is to be a bit more outgoing and engage people in some side conversations, he said, adding that otherwise, "You wind up living on an island."

With fewer remote openings and more applicants per posting, the job search can demand persistence.

From her home southwest of London, Allan has been looking for a full-time marketing role since May 2025. Last year, she said she was in a "blind panic, applying for everything," submitting more than 1,000 applications.

Now, Allan said, she is being more deliberate. Unless she fully fits the criteria, she doesn't apply, she said. Allan also remains upfront with prospective employers about Luther, who gets at least three walks a day, including one at lunchtime.

"If they get me, great," she said. "And if they don't, well, maybe it's not a great fit."

Do you have a story to share about your work setup? Contact this reporter at tparadis@businessinsider.com.

• CEOs are excited about AI, but increasingly worried about cybersecurity, KPMG US CEO Tim Walsh said.
• “The cyber risks have just elevated to places that we’ve never seen before," he told Business Insider.
• KPMG is creating a cyber-defense business built around AI.

Corporate leaders tend to be enthusiastic about AI's potential — and increasingly concerned about the cybersecurity challenges the technology brings.

Tim Walsh, CEO and chair of KPMG US, said the worries come up in nearly every meeting he has with fellow leaders, as AI gives bad actors new ways to try to breach corporate defenses.

"The cyber risks have just elevated to places that we've never seen them before," he told Business Insider.

Walsh pointed to the Hugging Face incident this past summer, in which OpenAI said an AI agent bypassed controls during an internal cybersecurity evaluation and accessed parts of the open-source AI platform's systems.

There isn't currently a defensive wall, he said, that's capable of rebuffing every cyber threat. He said KPMG is working with the frontier AI model developers and others on further protections.

The goal is to help the Big Four firm protect its business, and its clients' businesses, Walsh said, adding that he sees it as a potential opportunity worth more than $1 billion.

'Cyber insecurity' fears

Unease about AI and cyber threats showed up in a recent KPMG US survey of 400 CEOs at major US companies. While leaders reported confidence in AI's potential, cybersecurity was the concern they identified most often.

Eighty-five percent said cybercrime and "cyber insecurity" could affect their company's prosperity over the next three years — more than said the same about inflation, geopolitical tensions, the pace of technological change, or other risks.

Cybersecurity was also the most commonly cited challenge to implementing AI. It topped ethical questions, data readiness, cost management, and translating AI spending into measurable returns.

Leaders said they were particularly concerned about identity theft and data privacy, vulnerability to cyberattacks, and fraud detection and prevention. Nearly half said they planned to increase cybersecurity investment over the next three years, citing threats including AI-powered social engineering, AI-assisted phishing or malware, and data and privacy risks tied to AI agents.

A growing need to defend and check AI

The concern is shaping the kinds of work the firm wants to do for clients.

Walsh said KPMG is building what he described as a managed cyber-defense business centered on AI, meant to serve as a "shield and defense mechanism" for companies. KPMG already has a cybersecurity business, he said, though this would be a different offering built around AI.

The company also sees a growing need to check whether the AI systems organizations deploy are doing what they are supposed to do. KPMG already helps clients assess AI-related controls and governance. Walsh said the firm is developing additional services to verify that AI agents are operating as intended and give investors and others confidence that companies can control them.

"Trust around AI is a real thing," he said.