• Hilary Tang and her college friends bought an akiya in Hiroshima, Japan, for a little over $11,000.
• The group of friends spent months living at the property while renovating it.
• They plan to use it mostly for gatherings but are open to renting it out to cover yearly costs.

This as-told-to essay is based on a conversation with Hilary Tang, 23, a recent college graduate from Hong Kong who purchased a home in Hiroshima, Japan, with her college friends. The following has been edited for length and clarity.

I graduated from Minerva University in San Francisco last May.

I was planning to work at a startup in San Francisco, but I decided that I wanted to take a gap year. At Minerva, our cohort is pretty diverse, and I have quite a few friends from Japan. One of my friends had this concept: "There are these akiyas, but no one actually buys them."

I actually never saw any of those videos about akiyas before, but I did know about the 1 euro house in Italy thing. I didn't know there was a similar concept in Japan.

My friend was initially planning to buy a house with his high school friends, but they backed out very early on. After they backed out, he asked if we were interested in buying a house.

That was in June. We bought the house in late July, and then we got the keys on August 6.

At first, we were trying to recruit people, but no one really wanted to. We even tried to recruit outside our school. I tried asking people from Hong Kong, but no one wanted to go somewhere random and buy a house in Japan because there's quite a lot of risk.

From the initial six people who bought the house, five people are from my university.

Then two other people joined, because my friend's friends also came over after we started the renovation. They're from Japan and really liked the house, so they decided to chip in as well. So currently, we have eight people.

We always wanted to have eight people in the house — it's just easier if we have a bigger budget.

We wanted to buy and renovate the house for less than $20,000

After we assembled the people who decided to buy the house, we had an initial meeting to understand each person's motivations and expectations, because that would determine what kind of house we buy and how we want to treat it.

When we were talking about things we would want in the location, something that was common was that, firstly, we all preferred being in nature or easily accessible to nature. Within the group, most of them are Japanese and already live in Tokyo, Osaka, or another big city, so for them, they wanted to have a second house in a more rural area.

Secondly, we wanted somewhere that is easily accessible, even internationally. Another friend is planning to work in the US, and there's also a Korean member, so it's better if there's more motivation, or it's easier for us to actually go there if there's an international airport nearby.

And thirdly, we wanted somewhere with better weather and with lower earthquake and tsunami risk.

We ended up finding a house in Hiroshima.

The house itself was 1.8 million yen (or $11,371), but the price was negotiated because the house was initially listed on the website at 3 million yen.

We also had to pay the agent fee and other fees, so we spent about 2.3 million yen in total.

The house is around 315 square meters (or 3,390 square feet), and almost 500 square meters of land.

We have nine Japanese-style rooms, which are rooms with tatami flooring, and two Western-style rooms, which are rooms without tatami flooring.

Initially, we wanted to do the whole renovation within $4,000, but since we have more people chipping in, our budget expanded. We still haven't used up our original $20,000 budget. Just for the renovation, we've used around $1,262, as of start of October.

We hang out there once a month, but we're also thinking about renting it out

We've been staying in the house the entire time we've renovated it, and luckily the house was in better condition than we expected.

The timeline was so tight that we couldn't actually go there to see the house before we bought it. But the agent did a video tour, and we looked around, and it was quite nice.

We also talked to our neighbors, because the person who lived in the house passed away about five years ago, and then afterward it was left vacant. But before he passed away, the neighbors said how the previous owner was really diligent with cleaning stuff; that they always saw him cleaning, even toward the end of his life.

When we got there, we realized it was actually a lot more well-maintained than we thought, so we didn't have to do a very big renovation. At first, we thought we'd have to change all the tatami, or rebuild certain parts, or put down certain parts. But it turns out there hasn't been a super big expense that would require us to rebuild the entire thing.

We did paint and also repaired some curtains and lights because they weren't working. We added a fire alarm and air conditioning because they only had one or two aircons, and it gets really hot in Hiroshima during the summer and really cold in the winter. Those wooden houses don't insulate very well.

When we first got there in August, there were five of us. Then maybe for the first three days, there was always someone new coming, because there are a lot of friends who wanted to come here. So there are always visitors, and they also helped out because there's a lot going on — we even had friends' parents come over as well.

That's been my favorite part.

You see sides of people that you don't know. Everyone has some sort of expertise to bring. For example, some people are really good at painting. Our friend helped us paint the bathroom wall — he wanted to paint a Fuji mountain, but none of us really knew how to paint. So I'm really glad he came and helped us paint.

There's a girl who went to a lot of auctions growing up, so she specialized in artwork and helped us go through the things the previous owner left behind.

It would be nice to do Airbnb and learn about the process and to experience what it's like to manage an Airbnb. Maybe with the house on Airbnb we can cover at least the running costs every year.

Still, we want to prioritize us hanging out.

Every month we try to gather there, and so far we've been going consistently once a month.

We wanted to create a place we could always come back to whenever life gets a little overwhelming, where any of us could take a break, have some space to ourselves, and take time to process whatever was going on in life.

We see this house not as an investment, but as a shared place among us.

• Jen Eaves' mother is 79 and lost more than $3,000 to online scams.
• Eaves now monitors her mother's finances and says that was a hard conversation.
• Digital caregiving is an important part of supporting aging parents, she says.

This as-told-to essay is based on a conversation with Jen Eaves, Digital Caregiving & Elder Fraud Advocate at Aura. It has been edited for length and clarity.

It's an odd shift in dynamic when you start caring for the people who always cared for you. My mother is 79, and lives with my brother, who handles most of her day-to-day physical care. I'm the one who handles the administrative side of care, like scheduling doctor appointments and keeping her safe online.

About six years ago, my mom had a stroke, and while she recovered fairly well, she wasn't the same cognitively as she had been before. Around that time, I began noticing her falling for scams online.

Once, she ordered a cure for diabetes, which she has. The product was supposedly being sold by a famous TV doctor. When she showed me the video ad, I could see it was badly done AI, with the supposed doctor's lips not matching his words.

There have been other scams and pitfalls, too: online orders that never arrive, or even a legitimate credit card that my mom opened without realizing what she was doing. All in all, she's lost about $3,000 to scams, though I've been able to recover most of it through her bank.

I've realized that I need to take a more proactive approach to digital caregiving to protect my mom's finances. Here's what I'm doing.

Approaching from a place of help and dignity

After my brother and I had taken my mom's keys away, her phone became her connection to the world. I wanted to respect that. While some people have to restrict their older parents' access to phones, that didn't feel right in my case.

It was critical to me that my mom kept her dignity and as much independence as possible. At the same time, I saw there was an emotional side to falling for a scam: she would feel frustrated and confused when it happened, and I wanted to spare her those negative emotions.

I never want my mom to feel like I'm parenting her. Instead, I pointed out the patterns I was seeing and emphasized I'm here to help if she's willing to let me be involved. The choice, ultimately, is hers. This would be a lot harder if she wasn't willing.

Talk about scams

My mom wasn't particularly tech savvy, even before her stroke. I've had to educate her about what scams look like. When she shared the famous doctor video, I pointed out the aspects that seemed AI-generated to me. I remind her that if it sounds too good to be true, it probably is. I emphasize that urgency is a big sign of a scam. The bank, I tell her, is never going to call you.

Once, she had a scam caller claiming to be Apple support. They asked for her Apple ID and password, which would have given them access to pretty much everything she has online.

Because of our conversations, my mom hesitated. She patched me into the call and asked the scammer to explain the situation to me. I was very proud that she recognized the scam and knew to ask me for help.

I monitor my mom's accounts

I worked in cybersecurity at Aura, which offers a lot of great products for keeping kids safe online. But my experience with my mom made me realize we were missing a whole vulnerable population: older adults.

I helped develop Trusted Family Access, which allows family members like me to see alerts from their loved ones' accounts, with permission. This gives me peace of mind that I can catch any issues quickly. It's also made other aspects of caregiving easier, like handling medical appointments, because I have access to all my mom's information in one place.

When my mom was scammed, it felt like I was a victim too. I spent hours calling her bank and credit cards to get her money back. If she were to lose her savings, it would impact the whole family. I'm grateful we've found a solution that empowers both of us to keep her finances safe.

This as-told-to essay is based on a conversation with Siobhan MacDermott, a 56-year-old tech founder based in Menlo Park, California. It's been edited for length and clarity.

I've never been underqualified for any job that I've applied to.

I was vice chair at Bank of America and principal at EY. I held senior roles in cybersecurity at AVG and McAfee. I've sat in boardrooms with Fortune 500 CEOs, advised governments, and built practices from scratch.

Then, in early 2024, when I was 54, I had to relocate from New York City to California for family reasons, leaving the management consulting job I'd held as a partner at The Consello Group. I didn't anticipate what could happen when someone tries to re-enter the institutional world in their 50s — particularly as a woman in a career space that doesn't fit neatly into a job description.

The most surprising barrier has been the gap between what I've actually done and what the market knows how to categorize. I'm worried because I'm not sure where the economy is heading, but I'm an absolute eternal optimist.

I'm not going to accept anything other than staying hopeful.

I felt like my job application was going into the ether

It's been frustrating to watch organizations that desperately need exactly what I've built not hire me.

When I started my job search, I reached out to my network to try to figure out what I could do, who'd vouch for me, and where open positions were. A lot of senior roles were being downsized, but I had a lot of people who initially wanted to help me find something.

The strategies that were a complete waste of time were LinkedIn Easy Apply, recruiter calls that went nowhere, and any process that involved a 45-minute competency-based interview with someone who'd never heard of the big companies I've worked for.

I spent the better portion of every day for over a year applying and looking for jobs. I obsessively searched on LinkedIn for new positions, applying over and over again on the site, company websites, emails, and more, but getting nowhere.

I sent out countless résumés and barely got any responses. These are jobs that I know I'm qualified or overqualified to do, but sometimes I didn't even get the courtesy of the automated "thank you for applying" response.

It was like my application went into the ether. I'd try to find the head of HR for these companies on LinkedIn and reach out to them because I wanted the feedback.

I started trying to think of interesting ways to get attention

The strategy that worked the best during my job search was bypassing HR entirely and using direct outreach to CEOs and board members.

I'd send them letters not even related to a job, but more of an observation of their company to get their attention. I tried to be crafty, saying, "Based on my external assessment of your company, here are some things that I think you should be doing as you think through your next quarter."

Reaching out to CEOs got me in the door, but then they'd send me down to somebody who was pretty junior who'd say, "You're overqualified for this job." They'd courtesy interview me because they'd been told to, but it didn't go beyond that.

Sometimes a CEO would send me to HR, and HR would look at my skill set and say, "It doesn't quite match."

That happened quite a few times.

I adjusted my LinkedIn profile to get a better response, and that helped

I changed my gender to male and back to female a bunch of times to see if it made a difference — I didn't change my pronouns, just my actual gender. I felt like I had more responses on LinkedIn being thought to be male than female.

I also think being in Silicon Valley, you age out a lot faster than you do in other parts of the US, and it's definitely a highly male- dominated space. I had those two things working against me from the get-go.

So I removed the first six years of my career from my work experience on LinkedIn, and I took the dates off of my degrees so that people couldn't tell my age. This made me seem seven to 10 years younger, potentially. Once I took those dates off, I felt like I got more engagement on the site.

My job search in Silicon Valley went nowhere, so I decided to pivot and launch my own venture

I started my company out of necessity, and also out of intellectual boredom. I felt like my brain was starting to rot.

It happened about a year into job searching, when I started feeling financial pressure and frustration. I didn't want my full-time job to be looking for a job. My search wasn't looking like it was going anywhere in the foreseeable future, especially out in Silicon Valley. If you're a computer scientist or an engineer, there are jobs available, but I couldn't find a lot out here not in that space.

I started thinking, what am I good at? What do I know? What are all the pieces that I could put together? What problem can I identify that needs to be solved? That came together pretty quickly, and I launched two companies — Khaos Holdings, a strategic risk-intelligence company, and TeenAegis, a child-safety intelligence business, in January.

We're raising capital, and if the capital comes in, that will be the end of my job search. If the capital doesn't come in, then I'll keep searching — but I've decided that whatever I do will be adjacent to the problem I'm trying to solve now.

One good thing came out of the 2 years since my last job

Being out of work for two years shifted my retirement timeline eight to 10 years from digging into savings. However, since my job search started, I've really homed in on what I want to do with the rest of my career.

The journey I went on was a little bit of a midlife crisis. I asked myself, "What's my purpose in life?" as opposed to "What job do I want to have?" and then identified what skill set could bring me to that.

What led me to where I am was really thinking through questions like: What are all the issues that matter to me? What legacy do I want to leave? How do I want to think about my future for the next 10 or 15 years? How do I want to show up every day?

In the beginning, I was going to apply to anything that I could qualify for that would get me some money. Now I'm not going to do that because I don't think that's going to actually be fulfilling or make me happy. My sense of stability has required a deliberate reframe — from "security comes from a salary" to "security comes from what I've built and what I know."

I'm determined to make this work, but I also realize it may not

The hardest thing is maintaining a positive attitude day after day. If my company doesn't work out, then it's not like I can stop trying.

Taking mental health breaks is important because it's overwhelming, lonely, and hard. You lose your sense of self-worth when you're in this position; people look at you like, "Oh, you're the person who's still looking for a job." So it's hard to continue to put yourself out there.

Still, I do believe there's light at the end of the tunnel. It's just the question of how long the tunnel is.

Do you have a story to share about navigating your career in your 50s? If so, please reach out to the editor, Manseen Logan, at mlogan@businessinsider.com.

• Mihirkant Upadhyaya has a Ph.D. and more than 10 years of experience at Intel.
• But at age 41, he embarked on gaining another degree to level up in his career.
• Upadhyaya says that doing an MBA equips him with skills that AI lacks.

This as-told-to essay is based on a conversation with Mihirkant Upadhyaya, 42, who works at Intel and lives in Oregon. The following has been edited for length and clarity. Business Insider has verified his employment and education.

After studying computer engineering for my bachelor's, I pivoted into physics.

Two master's degrees and a Ph.D. in nanoscale science and engineering later, I got my dream job in the semiconductor industry at Intel in 2015.

As my career evolved, I realized I also wanted to do an MBA to step up my game.

My Ph.D. gave me relevant skills to take on the workforce

During my Ph.D., I focused on a semiconductor manufacturing technology called EUV lithography. I was excited to work at Intel because it does both chip design and manufacturing, so I knew I'd get a good overview of the chip-making process.

You don't need a Ph.D. to work in semiconductors, as there are so many areas outside the lab you can work in, like finance and legal.

On a personal level, though, having a Ph.D. helped me feel prepared to step into the workforce. It gave me discipline and the ability to be comfortable with ambiguity. My research mindset and technical background gave me the confidence to take ownership of outcomes and tasks.

There were definitely moments where I had self-doubt doing a Ph.D. You watch your peers go on to earn big bucks after their bachelor's and master's while you live on a modest stipend. However, the experience shaped me into who I am. I'd say I'm more patient, sharper, and more resilient.

I reached a stage where I felt I needed more education to thrive in my job

After about five years in research and development at Intel, I moved into supply chain roles, which have involved managing relationships and negotiating contracts. At this point, I realized I was missing certain skills.

My current role has a greater emphasis on executive communication and financial analysis. When I presented to an executive team, my manager had to step in on a number of occasions to get the room to respond, making what I was saying more high-level using business-driven terms. I also didn't quite understand certain things when I worked with the finance teams on contract negotiations.

To step up my game, I started a two-year hybrid MBA course in September 2025, alongside my full-time job. It was energizing to get back to the classroom at age 41.

I take one week off a quarter to do in-person sessions, and the rest of the time I'm doing online learning three days a week. My company is partly funding this, which is useful since MBAs can carry a $100,000 price tag.

By the time I've finished my MBA, I'll have done nine years of postgraduate study, investing an estimated $100,000 into that education, aside from scholarships and tuition waivers. Without question, it's been worth it. I haven't pursued the degrees to accumulate credentials, but to serve my career at various stages of my life. The MBA is addressing a concrete skills gap I identified after years in my industry.

I believe higher education is helping me become more irreplaceable in the age of AI

The AI boom made me take a hard look at what I bring to the table. I saw that some of what I did could eventually be automated. That realization was humbling.

Instead of trying to compete with what AI is already good at, I wanted to strengthen the areas where I knew it fell short. AI is great at processing and analyzing information. It has scale and speed, but it lacks the truly insightful judgment that a person can gain from years of learning a skill.

In my previous role at Intel, I found that AI couldn't tell me how to troubleshoot issues involving new or custom-made equipment because the context was so unique to my situation.

Meanwhile, in my current role, while AI could probably help me generate financial models, it can't read the room, build relationships, or have synergy with another person. My MBA course benefits me in this regard because we do lots of group activities, even online through Zoom, where we can interact with each other.

I think that in the age of AI, finding a field you really care about, becoming an expert in it, and staying curious to keep learning can help you become irreplaceable.

Intel declined to comment in response to a request from Business Insider.

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.

• George Brett Olson is one of a set of comedians who've called out AI accounts for ripping off their work.
• Olson said he was upset with Meta for allowing the situation to persist on its platforms.
• Instagram's top exec said the platform is invested in promoting original content and would look into the issue.

This as-told-to essay is based on an interview with George Brett Olson, one of several comedians who have lately called out AI accounts for ripping off their jokes. It's been edited for length and clarity. Instagram head Adam Mosseri said he would look into what could be done about the issue and that the platform was invested in driving traffic to original content.

I started doing stand-up in 2021 after getting burned out from being a winemaker. I'd been doing live shows, and this joke I made about, ironically, AI stealing jobs went viral. The whole joke was about AI stealing jobs and people still blaming immigrants, which is very silly when the most powerful people were saying, "We're literally coming to take all your jobs."

Then a friend sent me the video of this lady doing the joke. He's like, "AI is for real, for real, stealing your jokes." It was basically me, in my clothes, but it's a 42-inch butt. It's just the pornification of women online. It was very strange.

I'd been doing that joke for a year. I thought of it after working out with my buddy, and we were talking, walking. It takes a lot of work to get a joke stage-ready. It's a lot of repetition, tweaking, driving from place to place to perform. Comedy's not easy. So it's pretty sad to see it happen, especially when the AI comedians who are stealing jokes have more followers than the people they're stealing from.

I asked the account behind the joke if she was real. She said yes. Then I asked, "Did someone help you do this?" And she just left me on read. She also left a comment saying, "Sorry, won't happen again," and removed a bunch of videos.

I've had a bunch of followers try to report it. Adam Mosseri, the head of Instagram, replied and basically said, "Not all AI's bad. We don't know how we're going to stop it, but people shouldn't be able to steal. Seems like we should do something about that."

[This was Mosseri's exact comment: "I don't think it's practical for us to try and ban AI content from the platform. It's gonna be harder and harder to identify, and it's not all bad content (though yes, there is plenty of slop). But we are very invested in trying to drive more traffic to original content creators, and if an AI creator is ripping off content wholesale, it would be good for us to work out what we can do about that. I'm not sure what it would be, but I'll make sure to talk to the team and look into it."]

I blame Meta, not the AI

I don't blame someone for stealing. That's just someone trying to make a buck with the tools they have available. We want to hold people responsible that do not have the mechanisms of power because we can't hold an institution accountable.

I feel demoralized more by Meta's response. The language that's coming from all of them is that we're powerless, and this is inevitable, and there's nothing we can do. 
And it's just not true. And you just have to sit, be powerless, which is demoralizing.

As a comedian, you just want to sell tickets to your shows, engage with live people. That's why most of us post on social media — so people see that you're funny so they come to your live shows. I do live shows every week.

If we flood the internet with agents, and we don't know the difference anymore between what's real and what's not, this could be the death of the internet. Hopefully more people come to live shows. Because the one thing about AI comedians is: You can't see them live.

• Nick Woodhead said he went 48 hours without sleep while helping patch a major website vulnerability.
• The CTO said that with security problems piling up, October feels like "the month of hell" for tech.
• Because AI makes it easier to find and exploit security gaps, Woodhead expects more disruption.

This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.

It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.

About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start.

I have some teams offshore, so I was able to jump on that with them.

It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement.

I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.

People are willing to help

One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.

Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.

That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help.

Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.

The month of hell

It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective.

I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.

OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic.

I don't think we're at the end of the road yet. There's going to be a lot more to come.

• Tiffany Tang founded DrinkFolks after a transformative journey across Asia in 2023 and 2024.
• Tang's layoff in 2023 led her to Bali, where she decided to extend her 30-day trip to over a year.
• DrinkFolks, inspired by Tang's travels, supports women-led farms and brings jamu to the US market.

This as-told-to essay is based on a conversation with Tiffany Tang, the 30-year-old founder of DrinkFolks. It has been edited for length and clarity.

I'm the founder and CEO of DrinkFolks, which brings jamu, a 1,300-year-old Indonesian herbal remedy, to the US as a prebiotic root tonic.

For the first two years of my career, I was an assistant director at a gallery owned by the first female fine arts dealer in America. From 2017 to 2021, I worked at Christie's International Real Estate in marketing and communications roles.

For the next year, I was a senior communications manager at CSM Sport & Entertainment before taking on a similar role at a fintech company that helped millions of Americans sustainably build their credit scores through rewards.

I felt positively about that job, but I was laid off in May 2023

I was grateful to work there. We were doing big things, and I really learned what it was like to be at a mission-driven company.

The most interesting thing about my layoff was how incredibly calm I felt upon hearing the news. Our CMO told me first, and she was a friend, my college professor, and an executive I admire and respect.

When she told me, I said I didn't blame her, and this was a time for a reset. Turns out, the layoff was the best thing that could've ever happened to me.

A few weeks after my layoff, I booked a one-way ticket to Bali

For a long time, my self-worth was my net worth — my title, my salary, my career trajectory. When the layoff hit, I lost my sense of self. Reflecting afterward, all I could think was: who am I without the high-paying job?

A few weeks earlier, I had watched the movie "Eat, Pray, Love." When the layoff came, something in me said that this was my moment. I opened Kayak, found a one-way ticket to Bali for around $1,000, and booked it. Bali felt approachable and warm.

What was supposed to be a 30-day reset changed the course of my life

I originally planned to travel in Southeast Asia for a month but ended up staying from June 2023 through August 2024.

My awakening happened on day three. One of the first things I did in Bali was a Panchakarma, a full-body Ayurvedic detox at a retreat in Ubud. There was an optional silent day; one of the first times in my life I rooted and looked inward.

Sitting with my journal, I knew I had to stay. I was still negotiating my severance, so I did the math: my savings, my investments, what each month would cost. When my severance came through a few weeks later, it jump-started the journey.

The deeper turning point was Hong Kong

Everyone I met understood me on an indescribable level. It was the only time in my life I was speaking Cantonese to people outside my family, reconnecting with my heritage. By the time I came home for the holidays, I had decided: I was moving to Asia.

The spark for the company was the women I met. Across Indonesia and Southeast Asia, I sat with women quietly building something of their own. I wanted to help these women build generational wealth for their families. I built DrinkFolks as a way to sustainably invest in them — 3% of every sale goes to women-led farms and nonprofits across Southeast Asia through our FolksFund — while supporting health stateside by bringing ancient wisdom into people's homes.

I started the company in January 2024, took every jamu class I could find in Bali, visited the source of jamu in Yogyakarta, and reformulated recipes in my Hong Kong kitchen.

By October 2024, I was back in the US, working with California food scientists to scale up my home-tested recipe. We launched in NYC in October 2025. Today, we're in 70+ stores across the US.

Living in Southeast Asia made the math work

My salary before the layoff was $160,000 a year, plus equity. When I set off, I had roughly $14,000 between savings and severance — my spreadsheet calculated 4.6 months of runway — and I felt comfortable investing that in myself.

I budgeted like it was my job. I tracked my actual spending obsessively for the first four and a half months and came in at roughly $7,700 total.

All-in, I averaged about $1,300 to $2,300 a month, including flights, lodging, food, everything. My money stretched furthest in Cambodia and least in Hong Kong, which was financially similar to New York City. For comparison: my overhead, including my mortgage, maintenance, electricity, and WiFi in New York today is about $2,500 a month.

In terms of cost of living comparisons, here's my breakdown

Healthcare was the biggest surprise, in the best way. I got into a motorcycle accident on the Pakse Loop in Laos, and seven stitches cost me around seven dollars, including painkillers and a week of antibiotics.

Cambodia was the best value. It's the most adventurous, outdoorsy country I visited, and I didn't want to explore alone, so I stayed in hostels for as little as $6 a night — partly a budget move, mostly a way to meet people. It's also where I met my first fellow Americans of the entire trip.

Hong Kong was the opposite — groceries and eating out gave me real sticker shock. I softened it with a genuine energy exchange: I moved in with a college friend and threw dinner parties several times a week, cooking meals for them in exchange for a place to stay. It was worth every dollar — I met some of my truest friends and future business partners there.

The layoff was honestly the best thing that ever happened to me

It gave me the confidence to build DrinkFolks, a better sense of my heritage, and a version of myself I'm proud of. I've learned to never say never, but right now, I'm exactly where I'm supposed to be.

My advice is to use your layoff as your launchpad. Things happen for you, not in spite of you. If you have even the slightest chance to live in that moment for yourself — for me, that was travel — take it as a gift and a blessing, not a crisis to survive.

Treat budgeting as freedom, not constraint. My money stretched so much further than I imagined. Clear parameters gave me the space to figure out who I am outside my job.