• Kate McNeil opened All the Tropes, a romance bookstore, six weeks after quitting her job.
• Despite concerns about market saturation, All the Tropes thrives as a niche community destination.
• Passion, perseverance, and local support helped McNeil launch her business.

This as-told-to essay is based on a conversation with Kate McNeil, a 41-year-old small-business owner based in Atlanta. It's been edited for length and clarity.

The idea to open a romance bookstore started during COVID.

I joined an online group of fellow romantasy readers, looking to connect with other people who also enjoyed my favorite form of escapism. That group had over 2,000 members, and it was difficult to feel a sense of community. Eventually, it broke off into local chapters.

After COVID, I didn't know of any dedicated space for these same readers to meet in Atlanta. That's how I started the journey to opening the first romance bookstore in my neighborhood. In the two years since I opened, more romance bookstores have opened up, including one less than two miles away.

I thought I'd retire from my teaching job

When I launched All the Tropes bookstore, I was working a job I thought I'd retire from. I taught theater at Decatur High School for six years. My students always came first. I didn't want those kids to feel like I wasn't present or that they didn't have my undivided attention, so the bookstore was a back-burner idea for a few years.

I'd get home from rehearsal at 11 p.m., conduct business research until 2 a.m., then get up at 6 a.m. and go to work the next day and teach.

I took my time to gain a full understanding of the market, but there were still challenges

I learned about dealing with publishing companies and book distributors, connected with local artists to showcase their work, and reached out to local authors. One of the biggest challenges was finding a place for the store.

I knew that I wanted to stay on the east side of Atlanta because I lived in Kirkwood and felt very connected to the community.

In 2024, I found a location a four-minute walk from my home, and I knew it was time to make my idea a reality. In May of that year, I quit my teaching job and prepared to open the bookstore by the end of summer on Romance Bookstore Day.

I had 6 weeks to get the store ready for opening day

I received the keys to the bookstore six weeks before the day I planned to open. The timeline I had for opening day came with a lot of risks. I had cashed in my retirement fund, quit my job, and had a large preorder of "Onyx Storm" before there were bookshelves in the store.

There were many times my friends and I didn't leave the store until 4 a.m. A local artist painted the shop; I printed my merchandise at a local shop in Kirkwood; and I created the fabric wall. There were many nights I had doubts that All the Tropes would come to fruition.

I was a mom with two young kids opening a niche business that, to my knowledge, would be the first in the state, but I was prepared. I had my accounts with publishers, and my branding was complete. Perseverance, my husband, my village of friends, and an invested community got me to opening day.

All the Tropes opened August 17, 2024, on Romance Bookstore Day. In the span of a few months, I went from a passionate high school teacher to the owner and operator of a romance bookstore.

An increase in niche romance bookstores in the city concerns me

Even in a city like Atlanta with several thriving independent bookstores, I wonder about the percentage of residents who read for fun and, more specifically, read romance. While becoming a general indie bookstore would allow me to sell so many other things, I still believe All the Tropes can continue to thrive in a niche market, despite oversaturation.

Unlike a large book retailer, All the Tropes is a destination spot people can come from out of town to visit. Our social presence and promotion of local writers and artists also offer something unique to readers.

All the Tropes could pivot to general fiction, but so far, more stores opening has not impacted store traffic or sales.

4 Things helped me turn my business idea into a reality

All the Tropes continues to thrive because of my original vision of creating a community space for romance book lovers to connect. We now have eight active book clubs and continue to see consistent revenue.

Passion, trusting my gut, therapy, and a supportive group of friends are the reason I was able to turn an idea I brainstormed late at night into a successful niche business ready to grow.

We are now ready for a larger space and to expand our three-person team.

Do you have a unique small business story to share? Email the editor, Manseen Logan, at mlogan@businessinsider.com.

• All hell broke loose this week after a security flaw in 70% of the world's websites was made public.
• It was supposed to be kept under wraps as a fix was deployed, but one researcher jumped the gun.
• Chainguard CEO Dan Lorenc told POLITICO why he decided to go public.

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard's CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.

While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a "grey area."

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale.

The cybersecurity world's long-established protocols helped prevent disaster scenarios in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see.

This "is what happens when AI turns up a flaw that's been hiding for years," said Eylam Milner, cofounder and chief technology officer at cybersecurity startup Echo. The vulnerabilities, he added, are "about as serious as it gets for the web."

Origin story

Understanding how this week's emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward.

The origins of the incident can be traced back as far as April, when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI's autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide.

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a long-standing practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing it to the public, meaning they don't hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was "disappointed" with Chainguard, it hopes to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."

After the leak — which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen "millions" of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon's cloud division also said the flaw is "now being broadly exploited in the wild."

One senior US government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

"The fire department is fighting multiple fires at once," the official said, adding: "The good news is they're all one-story structures on fire, which the fire department deals with all day, every day."

More to come

Dauntingly, OpenAI said there's more on the way. "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. "As soon as the frontier models came out, that's exactly what we said: This will be the trend," he said. "And actually that's happening now."

Thomas Caspers, vice president of Germany's cyber agency BSI, concurred: "We expect that [to be] happening more and more during the coming months."

AI also ramps up the risks once the flaws are out in the open. Cyber agencies' recommendation that organizations take their websites offline was "really a drastic measure," Caspers said. "We wouldn't have done that a few years ago or so." But because AI has made it quicker and easier to exploit flaws, "we had to do that," he said.

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

"It seems a little bit more complicated than expected to exploit," he said.

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

"There are three things that you have to do right now," said van Amelsfort from the Dutch agency. "And that's patch, patch, and patch."

John Sakellariadis contributed to this report.

The Axel Springer Global Reporters Network harnesses the resources of the company's newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.