Earliest Adopters: Pornographers and Criminals… What does this mean for you?

This week’s edition was going to be a follow-up where I start unpacking the fundamentals of how AI will impact brands, starting from the outside in (AI search, discovery, etc.). But current events led me to this topic for today.

TL;DR: People with the least to lose and the most to gain monetize every new digital technology first. Pornography was the first pre-recorded VHS tapes anyone paid for. The first app that put the whole internet on one network was built to share music for free. AI is following the pattern, and the first people profiting from it are not thoughtful businesses integrating AI into their internal processes. It’s pornographers making AI smut. And bad actors running good old-fashioned cybercrime with a tool that finds software holes faster than the people who wrote it can fix them.

This morning, October 21, 2026, a critical PHP flaw put roughly seven in ten websites under immediate threat (note: PHP is a historically popular programming language for building websites and web-based applications). So the first AI project at your brand or retail operation may not be something new and exciting; it may be pointing these tools at your website, POS, and payment stack to find weaknesses before someone else does.

The scene: this morning, 10 a.m. Eastern

The PHP standards team shipped a patch for two flaws (CVE-2026-109618 and CVE-2026-109619), rated 9.2 out of 10 on the “oh shit” scale. The short version: a stranger can send a web request to a vulnerable web site/server and run their own code on it, no login required. PHP runs about 69% of the websites whose server language is known. WordPress, Magento, Drupal, most booking engines you’ve never looked under the hood of. If your brand site is on WordPress, it runs on PHP.

The exploit, nicknamed PHP2Shell, leaked a day early with a video. Cloudflare’s CTO said they were seeing early attacks before the patch existed. Someone counted 1.3 million exposed servers. And two governments, CERT-EU and the UK’s NCSC, gave the same advice to anyone who can’t patch today: consider taking the site offline.

Read that again. The official guidance for a store or site that can’t fix this today is to CLOSE THE STORE.

The pattern

People like to say porn won the VHS-versus-Betamax war. That's a myth; tape length and licensing did it. But the sturdier version holds: adult titles were among the first pre-recorded tapes anyone paid for, years before Hollywood decided home video wasn’t just piracy. Film studios held committee meetings to explore the issue. The adult industry held inventory.

Napster, 1999. The first app that put tens of millions of ordinary people on a peer-to-peer network was a piracy app. At its peak, Napster had about 80 million registered users, sharing music nobody paid for. The legal version, the iTunes Store, showed up four years later.

Email got its first spam in 1994, when two immigration lawyers posted a green-card ad to every Usenet group at once, before most businesses had an address.

It’s the same every single time. The first adopters are the people with nothing to lose and only money to make. They are profitable first. The respectable ones arrive later, ironically, built on infrastructure (or hardened, professionalized infrastructure) the disreputable ones laid.

AI is following the script

While the headlines argue about whether AI will end the world, the people already making money with it are the people who always do.

Semperis surveyed 1,200 IT and security people in nine countries this month. 84% of ransomware victims said AI played a role somewhere in the attack: finding the weak spot, writing a phishing email tailored to a specific employee, and adapting when defenders reacted. 44% said their own AI agents got turned against them.

In April, Anthropic introduced a model it decided not to release to the public, mostly because of what it could do to software. By May, it and a dozen partners (Apple, Microsoft, AWS, Google, the Linux Foundation) had found more than 10,000 high or critical flaws in widely used code, including one in a cryptography library that runs on billions of devices, and had written working exploits for them. The lab kept it to the partners so the defenders would get there first.

Nobody has said AI found this morning’s PHP bug. It doesn’t matter. The capability exists, it is cheap, and nobody thinks it stays inside a dozen companies forever. “Anything connected to the internet” includes your website, your POS, your booking engine, the page where customers type in a card number.

What this means for you

I'm asked all the time where a brand should start with AI, and my usual answer is the boring stuff: the inbox, returns, the spreadsheet somebody updates by hand on Mondays. Today the answer is different. The first AI project is more likely defense. Three things, none of which need a budget line this week.

Know what you run. Make a list: every internet-facing thing you own, what it runs on, who patches it, and when they last did. If your site is on WordPress, Magento, or Drupal, or your booking engine is a PHP app, email your host or your agency today. One line: “Are we patched for CVE-2026-109618 and 109619, and as of when?” If the reply is “what?”, that is your answer. If you’re on Shopify, the storefront is Shopify’s problem. The blog on WordPress, the plugins, the separate reservations site: those are yours.

Point AI at yourself before someone else does. Hire someone who can, or learn to. Have a model read your site, your plugins and versions, the admin pages exposed to the public, the code in your public repos, the API key somebody pasted into a shared doc two years ago. It is the cheapest security review you will ever buy, and it is exactly what the other side is doing to you.

Know what runs when it’s off. The Harvard Business Review ran a piece this month on the first 72 hours after a cyber attack. The crux comes down to three items you can plan for: define what the minimum version of your business is (e.g., stripped way back, what’s the smallest successfully operable version of your business), if tech went away for a period, what are the by-hand fallbacks, and who has the authority to pull the plug on tech platforms. For your business, that is three questions. Can you take orders or payments with the website down? Does one named person know how to switch it off? Have you restored from a backup once, on purpose, to see if it works? Two governments told websites to go offline today. Could yours, and keep selling?

The efficiency question

Yes, AI finds efficiencies. I build those for a living. Inbox triage gives a CS team back hours a week. But a POS down for three days in November, or a customer list on a leak site, costs more than a year of those hours. Do the defense first.

Next issue: back to the nine basics, starting with the four that decide whether a customer can find you.

When did you last ask who patches your website? If you don’t know, that is the answer.

Jordan Williams, Loop Trails, AI implementation for outdoor, retail and hospitality brands.