On October 21, the PHP project released fixes for two serious security flaws in PHP itself. Researchers named them PHP2Shell (CVE-2026-109618 and CVE-2026-109619). WordPress runs on PHP. It also runs a lot of the landing pages, lead forms, and special pages dealers use every day.

An attacker does not need a login, a plugin bug, or a weak password. They send one specially built web request to a PHP page, and on an unpatched server that can be enough to run their own code on it.

Who is affected

Every PHP version from 5.4 through 8.5 that serves web pages, until it is updated. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 7.4, 8.0, and 8.1 are past end of life and have no official releases, so sites still on those need to move.

What to do

1. List every site with your dealership’s name on it. The main site, the blog, service and parts specials pages, old campaign microsites, the landing page an agency built in 2019. Forgotten sites are the ones that never get patched.
2. Ask whoever hosts each one: “Which PHP version is this site on, and have you applied the October 21 PHP security update (CVE-2026-109618 and CVE-2026-109619)?” Get the answer in writing.
3. If you’re on a managed WordPress host, they have most likely patched already. Confirm anyway.
4. If the site sits on its own server or a VPS, someone has to update PHP. If the answer is PHP 7.4, 8.0 or 8.1, ask for a dated plan to move it.
5. If nobody uses an old site, shut it down or turn it into plain HTML pages. A page with no PHP behind it can’t be hit by a PHP flaw.

One more thing we learned firsthand. Having Cloudflare or a firewall in front of your site does not stop this on its own. The attack looks like an ordinary form submission, so it passes straight through unless someone adds a rule for it.

What we did at DealerRefresh - thanks, @craigh, for the heads-up!

We checked every server the day after the announcement. Like most sites online since 2005, we had older PHP versions in the mix, so this applied to us.

That same day we added temporary blocks for the request patterns the attack depends on, and limited our test server to our own network. Then we built new servers on a current long-term-support release of Ubuntu with patched PHP 8.3, tested everything on staging, and moved the live forum over the next morning.

Our old WordPress blog was the pain. It has 1,784 articles going back to 2005, and nobody has posted there since 2023. Instead of upgrading WordPress and 48 plugins for a site we don’t use, we converted it to static pages. Every article still loads at the same address, and there is no PHP behind it anymore.

While we were in there, we also tightened database access, changed passwords, and added daily backups and uptime alerts.

If you’ve already asked your website provider about this, post what they told you below. Vendors, if you’ve patched your dealer clients, say so here. It will save many dealers a phone call.

Sources:
PHP2Shell: Critical PHP vulnerabilities patched, update now! - Help Net Security
php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®

Respectfully, worrying about Vehicle Top Ads hurting future VLA performance is like worrying about the possibility of getting a flat tire when your car is on fire!

Vehicle Top Ads is a beta and only OEMs can participate. The concern is that it may have an adverse effect on VLA performance, time will tell, but you know what is DEFINITELY having an adverse effect on your VLA performance right now?

Competing with your "partners" that are using YOUR inventory AGAINST you!

Do a few "near me" searches for vehicles you have in inventory. Scan that VLA grid and look for ads run by Cars, Carfax, Autotrader, Truecar, CarGurus, Auto List etc, with your city as the location. Click that ad and you'll see why an OEM only beta shouldn't be keeping you up at night.

Your 3rd-party "partners" are fishing out of your tackle box. They're using your inventory as bait to draw consumers to an SRP that introduces them to every competitive vehicle in the market.

Vehicle Top Ads should NOT be your top concern... Your car is on fire... stop worrying about potential flat tires.

If you'd like to discuss strategies and tactics to prevent this, reach out. I'd be happy to share a resource with you.

PS. I'm not anti-3rd party, shoot, I worked for three companies that had marketplace listings and still have friends there. They have a place in the marketing mix, but I firmly believe that place is not VLA with YOUR inventory.

Sundial is a DealerRefresh sponsor. This review introduces the product from the platform documentation its team shared with us and from its founder's post in the forum. Sundial is new to the community, so this isn't a summary of member experience yet. We'll expand it as members weigh in.

Overview​

Sundial is a contact-center and revenue-operations platform for dealerships: the phone system, the texting, the AI agents and the follow-up queue in one place. Most stores run those as four or five separate tools. The phones come from one vendor, texting from another, the chat widget from a third, and the BDC keeps the follow-up list in the CRM. Sundial's pitch is that all of it should live in one system, with AI working the same queue as your people.

The founder will be a familiar name to some longtime members. Andrew Smith spent twelve years as CTO of The Higher Gear Group, later OneCommand and then Affinitiv, so this is not his first dealership software platform. His forum post, "There is no AI silver bullet — and that's fine", is the best summary of how the product thinks: AI is a dial you turn up as you trust it, not a switch that replaces the BDC.

What it does​

• Phones. A browser softphone, inbound queues (round robin, ring-all, longest idle), an IVR builder, call recording and transcription. Reps can also call from their own cell phone and show the store's caller ID. A caller who waits past the hold limit goes to overflow (voicemail, an AI agent or another number) instead of holding until they hang up.
• AI voice and chat agents. Inbound and outbound voice agents plus website and WhatsApp chat. They use the newer full-duplex voice models, so a caller can interrupt the agent the way they would a person. Each agent has a set list of what it collects and what it's allowed to do. An agent can be told to take a full intake and promise a callback without ever offering to book.
• One inbox. Calls, voicemails, SMS, WhatsApp, email and web chat show up as conversations in one team inbox, with claim, assign and snooze.
• Speed-to-lead. Leads come in by API or ADF email, get routed (including round-robin to whoever has waited longest), and are timed against a response target. Late leads alert the owner and then escalate. Leads it can't read are kept and listed for retry instead of being dropped.
• Coaching and insight. Live call coaching, transcripts and summaries, scoring against the store's own scorecard, and a weekly digest of what customers are asking about across every channel.
• Battlecards. The store's own talk tracks show up on the rep's screen during a live call. When a customer brings up a competing store, says "Carvana offered me more for my trade," or pushes back on the payment, AI matches what the caller means and pops up the right card in the rep's window: what's true, why it matters to the customer, and what to say next.
• Deal desk. A live payment grid with no "save and calculate" step. Front and back gross are visible only to F&I and management, and a plain view hides cost when the tablet gets turned toward the customer.
• Attribution. Tracked links and call-tracking numbers credit sold deals to the campaign that earned them, and holdout groups measure whether a campaign actually changed outcomes. Won deals can be sent back to Meta and Google Ads so their bidding optimizes for sales instead of form fills.
• Compliance. Compliance controls are built in, not bolted on: DNC lists, opt-out and STOP handling, per-purpose consent records with an audit trail, configurable TCPA calling hours, and a self-serve A2P 10DLC registration wizard. Most controls are set by the store owner, and explicit opt-outs (STOP, unsubscribe) are always honored on automated sends.

The full feature list is in Sundial's platform overview.

Where it fits​

The clearest fit is a store or group with a BDC that's drowning in phones: missed after-hours calls, voicemails nobody returns, and leads that sit for an hour. The "dial" approach is a sensible way in. Start with an AI line that only takes messages after hours, check what's waiting each morning, and widen what it's allowed to do as the team trusts it.

Sundial does not ask you to replace your CRM. It's built to run alongside one, but today that means HubSpot, and the documentation lists other CRMs as coming next. For most franchise stores running VinSolutions, eLead, DealerSocket or a DMS-tied CRM, the integration question matters most (see below). Multi-rooftop groups get a parent account over the stores, with pooled seats and branding and phone numbers set per store.

Honest questions to ask on a demo​

• Your CRM, specifically. Run-alongside is HubSpot today. Ask exactly what syncs with your CRM and DMS right now: contacts, activity, appointments, deals. Ask what happens when the two systems disagree.
• Breadth vs. depth. The platform is organized into six areas, each with real depth: phones and contact center, AI agents and coaching, inbox and lead follow-up, campaigns and attribution, deals and revenue operations, and compliance and multi-rooftop administration. Ask which parts dealers use in production today and which are newest. Then decide whether you're buying the phone/BDC layer, the whole stack, or something in between.
• The AI line on your calls. Ask to hear real recordings of the voice agent with service and sales callers, including the handoff to a person. Ask what it is explicitly not allowed to say or promise.
• Service scheduling. Ask which scheduler it books into for your DMS, or whether it takes the intake and hands off to a person.
• Pricing and seats. Sundial publishes its pricing at sundial.click/pricing: a free single-user tier, then $19, $79 and $199 per seat per month, with custom Enterprise pricing for groups. Usage allowances are shared across the store. Extra minutes, texts, emails and AI credits come in prepaid top-up packs that are used after the monthly allowance, last 90 days, and are never billed after the fact. Ask which tier your BDC actually needs and how much usage a store your size burns in a month.

Bottom line​

Sundial is an ambitious platform from a founder who has built dealership software before, and it's honest about AI in a way a lot of this category isn't. The "turn the dial up as you trust it" approach is the right one. The phones, inbox and speed-to-lead core is what most stores will feel first. What it doesn't have yet is a track record here, and its CRM integration is HubSpot-first today. Treat this as an introduction. Take the demo, push on how it fits your CRM, and come back and tell the community how it went.

Book a demo →

Something I wish I knew when I was a dealer...

4 out of 5 sales do not use your service department

People who don't use service have a single-digit chance of coming back to buy another car from you.

Buyers who use service one time are twice as likely to come back to buy another car.

Your golden customers are the ones who used your service department 4 or more times before buying their next vehicle. They can represent nearly half your service customers.

If I knew this when I was selling cars, I would have introduced every customer to service!

Hey everyone,

I've spent a lot of years working with dealerships on digital marketing, and one thing that hasn't changed is the constant need for fresh content.

Whether it's promoting used inventory, creating graphics for a weekend sale, highlighting a new arrival, or putting together something for social media, there's always something that needs to be created.

And let's face it, not every dealership has a graphic designer sitting around waiting for the next project.

Over the past several months, I've been working on something called DealerAdGen, an AI-powered marketing platform built specifically for automotive dealerships.

The idea was pretty simple: What if a dealership could take a regular vehicle photo and turn it into a professional-looking marketing graphic in just a few minutes?

That idea grew into something a little bigger.

The platform now includes tools for creating vehicle spotlights, sales event promotions, social media graphics, marketing copy, and other dealership-specific creative. I've also been working on inventory integration and ways to make creating content as simple as possible.

One of my biggest goals was to build something that dealership employees could actually use without needing to understand complicated AI prompts or design software.

I'm not suggesting AI is going to replace good marketing people. Far from it. I see it as another tool that can help dealerships get more done with the time and resources they already have.

I've just launched the platform, and I'm at the stage where I'd really like to hear from people who actually work in dealerships.

A few things I'm particularly interested in:

• Are dealerships creating most of their marketing graphics internally, or relying on outside agencies?
• Would a tool like this be useful for your sales or marketing team?
• What's the biggest frustration when it comes to creating fresh content for inventory and promotions?
• Are there specific features you'd want in an automotive-focused AI creative platform?

For anyone interested in seeing what I've been building, it's at DealerAdGen.com. There's a free trial available if you want to experiment.

I'm still improving things and have plenty more planned, but I wanted to share it here because DealerRefresh has always been a great place for real conversations about automotive technology.

I'd genuinely appreciate any feedback, good or bad. Sometimes the most useful suggestions come from people looking at something with fresh eyes.

Thanks!

Shawn Ryder
Shawn Ryder Digital
DealerAdGen.com

We keep running into the same story. A dealer has been on an equity mining or service drive tool for about a year. The first few months looked great. Now results are dropping fast, and text opt-outs are climbing.

No wonder... the customer comes in for an oil change and gets an upgrade offer. The monthly equity email shows up. On the next visit, there’s another offer. Most people ignore the text, but the system keeps firing the same message later. They finally opt out.

We have found that 1 in 8 service customers buy in the next 12 months. The other 7 are going to say no, and a lot of them hear the pitch every time they come in. The tool counts the deals it finds. It doesn’t count the customers it wears out. When those customers text STOP, your service reminders usually stop going out to them too.

• Are you tracking opt-outs to your equity texts? Have they climbed since you started?
• Does messaging change on subsequent customer visits?
• Is the tool only focused on trades/acquisitions? Does it present other options for the customer?