In October 2026, there were several important developments related to website security, search engines, and artificial intelligence. Critical vulnerabilities in PHP created an urgent need for action, while Google introduced new features for AI search and the enterprise use of Gemini. There is also news regarding browser security.
We’ve compiled four developments that businesses and digital leaders should be aware of.
Critical PHP Security Vulnerabilities: What Website Owners Need to Know Now
In October, two critical security vulnerabilities in PHP were disclosed that could pose significant risks to websites and web applications. PHP is a widely used programming language that is employed, among other things, in content management systems such as WordPress.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow malicious code to be executed on affected servers under certain conditions without requiring attackers to authenticate themselves first. The European cybersecurity agency ENISA and CERT-EU therefore urged organizations on October 21 to check their systems as soon as possible and install available security updates.
Which PHP versions are affected?
Security updates have been released for the PHP 8.2, 8.3, 8.4, and 8.5 branches. Older versions that are no longer under active support should also be examined with particular care. On October 23, CERT-EU also reported another vulnerability, though it affects only unusual application configurations.
For businesses, this means that even if their website appears to be functioning without issues at first glance, there may still be a need for action behind the scenes. The key factors are which PHP version is actually running on the server, whether security updates have been installed, and which other software components are in use.
For WordPress websites in particular, it makes sense to regularly check not only plugins and themes but also the underlying server environment. This is because a website’s security depends on multiple technical components.
Our tip: Companies should work with their hosting or web development partner to verify that affected systems have been fully updated. Applications accessible to the public should be given priority.
Google Makes Sources More Visible in AI Search Results
AI-generated answers have become an integral part of Google Search’s ongoing development. With AI Overviews and AI Mode, users can access information directly within the search interface. For website operators, this raises the question of how their content can remain visible.
On October 15, Google announced several changes designed to make it easier to access additional sources.
Among other things, links are expected to appear more frequently directly within AI-generated answers and be placed more prominently. In addition, Google is testing dedicated sections for official websites, such as when users are looking for a specific point of contact. The display of news sources and related articles is also being revamped.
These changes are intended to make it easier for users to navigate from an AI answer to the original source of information.
What does this mean for businesses?
For websites and content managers, the quality of their own content remains a key factor. Those who answer relevant questions clearly, present expert knowledge in an accessible way, and provide unambiguous information lay a solid foundation for their digital visibility.
However, it remains to be seen whether these new display formats will actually lead to more website traffic. After all, a visible source link does not automatically mean that users will click on it.
Nevertheless, this development highlights how important it has become to consider one’s own website in the context of AI-powered search results.
Google Cloud Introduces Gemini Agent for Enterprises
On October 8, Google Cloud announced Gemini Agent, a new AI assistant designed for enterprise use. The goal is to enable users to handle more complex tasks through a centralized AI interface.
Unlike simply asking a chatbot a question, Gemini Agent is designed to plan multi-step workflows, utilize appropriate tools, and incorporate information from connected enterprise systems.
Google describes use cases such as researching and processing information, creating documents, assisting with development tasks, and handling activities within existing work environments.
To do this, the agent is designed to access shared corporate information, link various work steps together, and deliver results within the applications employees are already using.
What opportunities does this present?
What is particularly interesting for businesses is that AI is increasingly capable of supporting entire workflows. Examples include automated research, pre-prepared analyses, or the creation of documents based on existing information.
To ensure that such systems can be used reliably, clear access permissions, the quality of the underlying data, and transparent control processes play a crucial role.
That is why Google is prioritizing security, management, and governance features for businesses with the Gemini Agent.
The actual benefit in day-to-day work ultimately depends on how well the solution can be integrated into existing processes.
Google Chrome now issues clearer warnings about insecure HTTP connections
Google introduced another security feature for Chrome in October. Since October 21, the browser has, by default, been prompting users to confirm before establishing an unencrypted HTTP connection.
Previously, such websites were primarily flagged with warnings such as “Not secure.” The new warning appears even before the connection is established, thereby better protecting users from potential risks.
The reason: With an HTTP connection, transmitted data can, under certain circumstances, be read or manipulated by third parties. HTTPS, on the other hand, protects the connection through encryption.
Chrome uses the “Always use secure connections” feature for this purpose. There are exceptions for certain local network addresses.
Why is this relevant for website operators?
HTTPS has long been one of the fundamental technical requirements for a professional website. An additional browser warning can unsettle visitors and, in the worst-case scenario, cause them to leave a website.
Companies should therefore ensure that their website is fully accessible via HTTPS. This also includes making sure that redirects are set up correctly, certificates remain valid, and embedded resources are loaded securely.
This change underscores the importance of technical security for a reliable user experience.
What sticks with you
Developments in October demonstrate just how diverse the demands on modern websites and digital processes have become. Security updates must be implemented promptly, while new AI features open up additional possibilities for search and day-to-day work.
It is worthwhile for companies to regularly review the technical foundation of their digital presence and to closely monitor new developments. This allows them to identify risks early on and take targeted advantage of new opportunities.
