After visiting the first Zuzalu, I was pretty sceptical about pop-ups. They’re starting to come of age now, though. Wide reach, real world results and proper business models. I’m bullish.

Bitcoiners called it again. A few months ago, Bitcoin was the canary in the coal mine. Over the summer, the Bitcoin ecosystem was hit first: the Coldcard firmware exploit, emergency patches at Core Lightning, and a flood of AI-generated bug reports. The base protocol held. The weaknesses were in the software built around it, and the response was a volunteer red team pointing AI at hundreds of Bitcoin repositories and fixing what it found in the open. This week the rest of the internet got its turn. PHP2Shell, a set of flaws that had sat in PHP for over a decade, was found with frontier AI models and patched on 21 October. PHP runs roughly three quarters of the web, and governments took their own sites offline while they scrambled to update. Bitcoin went first because it is the biggest open bug bounty in the world, and anything with money attached gets probed first. Banks, payment rails, hospitals and government databases are next, and most have relied for decades on obscurity and slow attackers. That cover is gone. It will probably be quite painful for a while. What survives will be simpler, tougher and more honest about its own weaknesses. Stress is how resilient systems get built.

A Free City can import a tax code, a court system and a set of regulations. It cannot import a culture. That has to be established by the first people who move there, which may make choosing the pioneers more important than choosing the laws.

Some conversations are so fascinating you just don't know when to stop.

Thanks to everyone who's stuck with us. Getting stronger every week.