This month, the Digital team brought back a fresh set of takeaways from BrightonSEO 2026, we started shipping our 25th anniversary beers out to clients, and the team hit the lanes for our second bowling social. On the work side, Althea shares her CRM playbook for Black Friday and Cyber Monday, we cover what the PHP vulnerability meant for our clients’ sites, and we say hello to Darcy, our new Senior Data Analyst. As always, there’s a look at what the team has been up to outside the office too.
We think a little discomfort is a good thing. Especially in the creative industry.
If we’re always comfortable with what we’re doing, the ideas we’re sharing and the work we’re putting out into the world, are we really pushing ourselves far enough?
Great work doesn’t come from playing it safe. It comes from questioning things, challenging each other and exploring ideas that make us (and sometimes our clients) a little nervous. And that’s exactly where we should want to be.
The brief. The world around you. Your own preconceptions. How things have always been done and how we’re told they ‘should’ be done.
Especially when it comes to brand.
Don’t just accept what’s in front of you. Ask why. Challenge assumptions. Look at things differently.
Some of the best ideas come from asking questions. Our job as designers is to listen as much as create.
Challenge yourself to do the best work of your life. Work you’re genuinely proud to put your name to (and can’t wait to show your mum, even in your mid thirties).
Challenge each other. Share ideas, push the creative, inspire one another and be open to having your own ideas challenged. We’re never shy of a frank opinion in our workshops.
And challenge your clients. Trust your gut. They hired you for a reason. Build relationships where you can have honest conversations, question each other’s thinking and push beyond what’s expected. You won’t just create better work, you’ll become better friends too.
Crazy, right? We literally get paid to come up with the best ones.
But often it’s the ideas you’re not quite sure about, the ones that feel ridiculous or you’re almost scared to share, that lead to something great.
An off-the-cuff thought sparks a conversation. That conversation takes you somewhere unexpected. And somewhere along the way, there’s a nugget that becomes something brilliant. These are the ideas that brands are remembered for.
Who knows, it might even be the next ‘Just do it’.
That discomfort can take all sorts of forms. It might be bringing difficult truths or misalignment to light in a strategy workshop. Presenting a wild third creative route that makes everyone a little on edge, or hopefully, excited about just how far we could take things. Or losing yourself down a rabbit hole of a concept that feels miles from the obvious, only to loop back to something brilliantly aligned.
An idea that doesn’t just look or feel different, but moves things forward strategically, emotionally and commercially. That’s the sweet spot.
If we start somewhere safe, there’s a pretty good chance we’ll end up somewhere safe. And god forbid, somewhere BORING.
That’s not in our DNA. Not at Fanatic.
Keep your BFCM sign-up form separate from your standard one, and gamify it where you can. A single question with a few button options improves your first-party data without asking people to fill in a long form.
Sending your biggest offer to a dormant list, landing in spam because of inconsistent sending, and measuring BFCM success on revenue alone rather than tracking repeat purchase rate.
If you need help with running a Black Friday/Cyber Monday CRM, email or SMS campaign, then simply get in touch and we’ll tell you how we can help put your business in front of the people who matter most to you, at the time that matters most to them.
In October, two newly discovered flaws in PHP, the language that still runs around 70% of the world’s websites (including WordPress, which sits under our own site), triggered one of the more chaotic patch days anyone can remember, and one with an unusual origin story.
The flaws were originally spotted in August by a researcher at security firm Calif, using an AI model built by OpenAI. OpenAI then spent two months working alongside the PHP Foundation’s own security team to get the fixes ready before going public, an effort OpenAI has since called “Patch the Planet”
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, both scored 9.2 out of 10 for severity. One was a memory corruption bug triggered by an out of memory condition, allowing an attacker to run code with the same privileges as the web server itself. The other was a use after free flaw in PHP’s file upload handling, exploitable without needing to log in at all. Both had apparently been sitting in PHP’s codebase since version 5, which dates back to 2004.
The PHP team had planned a coordinated release, but details leaked early, including an inflated severity score of 10.0 circulating before the official one was confirmed. That forced the team to bring the patch forward by a day, to 21 October. Once it landed, attackers moved fast: Cloudflare logged hundreds of thousands of exploit attempts within two hours, and Amazon’s security team saw proof of concept exploits being used against their own systems almost immediately.
The fallout went well beyond tech circles. Dozens of UK government sites went offline as a precaution, along with the Metropolitan Police, the National Cyber Security Centre’s own site, several BBC microsites, and councils across the country.
The fix itself is straightforward: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, all released on 21 October. PHP’s own core team was clear that nothing short of the update is a real fix; any interim mitigations only reduce the risk.
Due to the way we manage our servers and infrastructure, we were able to push out the relevant patches to all of our servers quickly before the exploit was widely reported. This ensured that all of our client’s websites were protected swiftly, we spent some time internally to review the patches and double check if there were any issues with any of the sites, but it is highly unlikely that any of our servers were affected.