• Per Happenings, Panic
  • The FCC Strikes Again
  • Duo, You're No Treo

Per Happenings, Panic
Once upon a time, in 1994, to be exact, PHP stood for Personal Home Page Tools. It was created by Rasmus Lerdorf as a set of scripts he used to manage his website. Over the years it has morphed into a powerful programming language used on countless web servers running Linux and becoming the foundation for many services including website platform WordPress, content management system Drupal, and Adobe's e-commerce platform Magento. Because PHP has been around for a long time, like all things created by humans, it has flaws. But many of those flaws have remained hidden under the surface, not easily identified and isolated by other humans. But with AI tools, those old flaws can now be brought to the surface and easily exploited in moments. This has been a growing concern over the past several months as tools like Anthropic's Mythos and OpenAI's Astra have shown improved prowess at discovering software bugs that can be used to take down essential platforms and critical infrastructure, spawning new efforts and groups designed to help governments, public services, and major enterprises harden their software and engage in more active surveillance of their systems. There were some at the time who scoffed a bit at Anthropic's language around the threat and accused them of mere fear mongering for marketing's sake. As time passed, we started to see AI models and agents wreak a little more havoc here and there around the internet, each time seemingly unnoticed for far too long by the workers that should have been watching and paying attention. These antics started to get more attention, the kind of attention they probably should have had all along, but now we are more primed to understand the capabilities of AI and how its real risks are at least as significant as its potential benefits. In this wake, we learned earlier this week that 2 major vulnerabilities had been identified in PHP even as the team that maintains it was scrambling to create the patches to resolve them. These flaws could allow hackers to use AI tools to take control of websites, steal data, and install malicious software on at-risk servers. As awareness and dismay spread across the internet, many sites, including official government sites across the world, were taken down to preempthacking attempts. Platforms rushed to apply patches as they were made available. On Wednesday morning, I noted on social media that this story was such a big fat deal that it had totally taken over Techmeme.com, a site that lists the hottest news stories of the moment. This was a significant feat because it was iPhone Duo Embargo Day, a new tech holiday celebrated worldwide with YouTube videos and written reviews on all the major tech sites so all the people who already pre-ordered one can know in advance if getting up early to place a pre-order only to be told they won't get it until November at the earliest and January at the latest was worth all that effort. One had to scroll to nearly the bottom of the page to see the first iPhone Duo story when the page would have otherwise been plastered with iPhone Duo stories. This was a major event, making it to mainstream news media, aiming to do their best at communicating a very nerdy topic to a wide and varied but generally non-technical audience. The bottom line? The internet, as TechCrunch reporter Sarah Perez noted, was having a very bad cybersecurity day.

Security researchers, using AI, identified the PHP issues as early as August 19, 2026. Some aspects of the vulnerabilities were known, but were considered too complex to easily exploit. But using AI tools, researchers were able to quickly spin up ways to exploit the vulnerabilities and reported their findings to the PHP team. The team began working on fixes on September 21 with the aim of releasing them on October 22. But news of the nature of the flaws leaked on October 20, placing pressure on the team to deliver the patches sooner. The flaws were publicly announced on October 20 so that platforms and companies could take the appropriate steps, but the flaws were likely already being used even before the patches were provided as Amazon claimed to have identified instances of attempted exploits as early as October 17. The patches themselves were released on October 21. Yet providing the patches themselves can also accelerate hacking as hackers can analyze the patched code to develop new exploits.

Fortunately, so far, no major catastrophes have been reported although there are widespread reports of active exploits. Ultimately, the major platforms applied the patches as they became available and vulnerable sites running old software began looking for upgrade paths. There is a path forward here. But in some ways this was a best-case scenario. The flaws were identified by security researchers and the people responsible for fixing them were notified in advance and had time to patch. In future scenarios, hackers will find the vulnerabilities before the researchers do and use them to wreak new havoc on unsuspecting systems and platforms. Having AI tools is necessary to help bounce back from these situations, but ideally, systems need to be constantly monitoring for vulnerabilities and actively working to patch them to stay ahead of would-be hackers. For all of the noise the United States government and American frontier AI labs have made on improving security and communication, we still don't have a path forward there. The 120-day clock is ticking on the AI/SI Task Force, but other clocks are ticking as well and we're unlikely to be prepared for those alarms when they go off.

Please stay up-to-date on your software updates, everyone.

The FCC Strikes Again
Earlier this year, the United States Federal Communication Commission banned foreign-made consumer routers and power inverters and not long ago they added foreign-made autonomous and remote-controlled robots (including vacuums pool cleaning robots) to their list. Now the FCC has added dashboard cameras and consumer wireless video transmitters with embedded technology from Chinese tech giant Huawei or other companies on the "Covered List", which confusingly means the banned entity list.

Since the original router ban, exceptions have been provided for major manufacturers such as ASUS, MSI, Eero (Amazon-owned), and NetGear. I mentioned previously in a TTNN article that it was not clear how and why these companies had been given exceptions since no one has yet moved production to the United States, nor do there seem to be any real indications that movement is beginning. There has also been no reporting on whether any security concerns have been mitigated. There have not yet been notable exceptions provided for robots or power inverters, but these are relatively recent additions for industries that aren't quite yet mainstream in the United States.

But unlike consumer routers, not all dashcams and wireless video transmitters were banned, so there will still be options available on the market. But no one should hold out much hope that the specific models that are banned will obtain exceptions. Huawei has been the poster child company for the United States government's fears of a Chinese planet. Huawei once had a larger consumer-facing presence here in the United States, but they were placed on the aforementioned covered list back in 2019 and became unable to sell their products here. In 2020, they were designated as an official threat to national security and US telecom companies were restricted from entering into new agreements with Huawei for telecommunications infrastructure using government subsidies. And then in 2022, the FCC officially adopted rules against approvals for any new telecommunications or video surveillance equipment made by Huawei. The official statement from the government is that China's 2017 national intelligence law mandates that Chinese corporations assist the government with national intelligence investigations and this could lead to companies like Huawei needing to share sensitive American data with the Chinese government. There were also concerns about Huawei's founder's ties to the Chinese Communist Party.

Because of the specific concerns around Huawei itself, we should not expect to see exceptions for any product that contains components from Huawei or any other Chinese technology company on the covered list. Fortunately, most Americans are already used to being blocked from technology coming from Huawei, so these new restrictions aren't likely to impact Americans in any meaningful way. But we should expect to see new product categories and specific products added to the list for the remainder of this administration's time in office.

Duo, You're No Treo
One of the apparent benefits of wide-body foldables is that they are smaller, easier to hold, and therefore easier to use one-handed. YouTube is full of videos from people who have reviewed the Microsoft Surface Duo, the original Google Pixel Fold, the Samsung Galaxy Z Fold8, the Huawei Pura X Max, and the Xiaomi 18 Fold saying how nice it is to use the phone closed and how much more pocketable it is than tall-body foldables like the Galaxy Z Fold 7 and Z Fold8 Ultra. You don't have to strain as much to get your fingers to the top of the phone. And perhaps it's because Apple insisted on putting the controls on the right of the screen in an unmovable taskbar that complaints about fingers stretching to the left of the phone to access notifications are more common. Some reviewers were vocal in establishing that the iPhone Duo is a two-handed phone despite its compact size. Few people really care if a left-handed person finds the user interface of the iPhone Duo to be optimized for the ~90% - most lefties are used to constantly having to adjust to the world - but when right-handed people are grumbling about usability, even lefties like me take notice.

It's just one complaint among many that surprised me. I am so used to iPhone embargo day being an onslaught of videos either talking about how the new one is the best one yet (duh...) or it's just a little bit better than the last one so don't worry about upgrading unless you have one that's 3 or more models behind. It's rare for people to have complaints about usability and even rarer for people to report of bugs and inconsistencies in the user interface. It was almost like.... reading an Android phone review on an Apple-focused technology site. Apple has typically prided itself on superior design in hardware and software and has often acknowledged accessibility issues with carefully considered options and settings to address them.

Many reviewers have also noted that it seems that Apple could have avoided many of the interface issues if they had adopted the iPad user interface on the interior screen rather than force developers to update their apps to fill in the extra space at a minimum, or optimally, take full advantage of it. While I agree in principle, Apple's likely view here is that these things are all separate. The iPhone Duo is an iPhone. It just happens to be a wider iPhone in all postures. Therefore, in the Apple universe, it runs iPhone apps. It is not an iPad, and just because it has a bigger screen does not mean that anyone should expect it to work like an iPad. If you want to run iPad apps, you must buy an iPad. And likewise, an iPad is not a Mac. If you want to run Mac apps, you must buy a Mac. Despite Apple stepping into the blurred lines phase of their existence by adding pen support to the iPhone Duo (someday, anyway), a windowed desktop-like interface to the iPad, and touchscreen functionality to the Mac (maybe next week?), these all remain isolated product lines. After the demise of the iPod, Apple stopped trying to build convergence devices, especially those that compete with their own product lines. "Please Buy All The Things" is Apple's current motto. And they continue to leave you with little niggles here and there that are often only mitigated by buying another Apple thing.

Nevertheless, some of the iPhone Duo's issues will be resolved over time, especially in the realm of apps. After all, anyone who is willing to spend $2000 on a base iPhone Duo is probably a person who will also be willing to spend money on software, so apps will get updated, especially paid apps in lucrative niches like productivity and creativity. The issue of apps parked in the middle of the opened phone looking like lonely dynamic islands of data will eventually be a non-issue, at least for apps that are still being actively maintained. And Apple will probably eventually allow the taskbar to be moved to the left side as it just seems like a gaping accessibility issue. The software glitches will surely be addressed in future operating system updates and as they've done with iPadOS, they will continue to advance the user interface to make it more functional, even if not necessarily more intuitive. And the biggest complaints people have with the hardware will be addressed with next year's iPhone Duo, which will be lighter, have better cameras, and will likely have FaceID since EVERYONE HATES THAT IT'S MISSING. First world iPhone user problems. 😀

I think the iPhone Duo is a clear example where the need for secrecy can work against Apple. Apple could have seeded iPhones Duo to several critical software partners and well-known developers so that there would be more optimized apps at launch. They could have even shown more of them off in the launch event video to generate even more excitement. While Apple did update their developer tools so that devs could see how their apps performed on the larger screens, there is nothing like having a device in hand to see how it really responds when you physically manipulate it. Once more developers have phones in their hands, software updates and new apps are sure to follow quickly.

YouTube reviewers are nearly unanimous in their conclusion that no one except early adopters should buy the iPhone Duo right now. Some reviewers have even expressed joy at the thought of going back to their regular iPhones (I read you, John Gruber). It's really the first iPhone cycle where reviews have been so negative overall. It has been surprising and in some twisted way, refreshing to see. It almost feels like people are being more honest this time around. But it may also be just that this is a very expensive phone with many obvious flaws and that's uncommon for an iPhone so people can't help but to speak of them.

But as they keep saying with AI, this is the worst the iPhone Duo will ever be. I still wholeheartedly believe this phone will make foldables more mainstream, even if it takes time because of pricing and availability.

And as a tech lover, I'm grateful for that.