28creation
Newsletter

28creation: Work software, automation and AI, explained.

Guide Work software

In our test, one LibreOffice import read 1/2 as January 2 under US settings and February 1 under UK settings.

Excel CSV imports that mangle zeros and dates: 12 traps tested

  • On a sample CSV with 12 trap columns, guessing importers changed up to 18 of 24 cells; importing as text changed none.
  • Excel 365 and Excel 2024 can now switch off four of these conversions; Power Query can load every column as text.

What you can do with this

Before you open a CSV with IDs, ZIP codes or codes like 3-4, import it with every column set to Text, then convert only the columns you know are numbers or dates.

Read the full piece
Analysis Automation

An Outlook to SharePoint and Teams flow costs $0 extra on Microsoft 365, and from $239.88 a year on Zapier.

Power Automate vs Zapier for Microsoft 365: 35 apps checked

  • Microsoft 365 plans include Power Automate with standard connectors only. Of 35 common apps we checked, 14 are premium there and QuickBooks Online has none.
  • Zapier bills each action and keeps SharePoint, Salesforce and QuickBooks for paid plans, but its Excel app can start a workflow on a new row.

What you can do with this

List the apps your flow touches and check each one's class on Microsoft's connector page. All Standard: build it in Power Automate for $0. One Premium: weigh a $180 yearly owner license against Zapier.

Read the full piece
News Work software

On Nextcloud 29, the newest built-in Collabora app on offer is June's 26.4.104, below the 26.4.303 fix.

Nextcloud Collabora flaw joins CISA list; 29 and older get no fix

  • CISA added CVE-2026-110447, a login-free command injection in Nextcloud's built-in Collabora server app, to its exploited list on October 23.

What you can do with this

Run occ app:list on your Nextcloud server. If richdocumentscode is there, update it to 26.4.303 or later, or remove it; disabling it does not close the hole.

Read the full piece

Get the short reads by email

New analysis and guides on work software, automation and AI. At most one email a week.

Look for an email from newsletter@28creation.com asking you to confirm. What we store.

Guide Automation

On five sample bank statements we made, one free tool, Camelot, read all 154 transactions exactly.

Bank statement PDFs to Excel: 3 free tools tested on 5 layouts

  • When a statement prints a running balance, a script can check each extracted row against it and flag lost rows and wrong amounts.

What you can do with this

Download CSV from your bank first. For PDF-only months, run the script in this guide and fix every row the balance check flags. It will not catch a wrong date or description.

Read the full piece
News Developer tools

Installing the Brotli package alone made requests, httpx and aiohttp start asking servers for Brotli in our check.

Brotli flaw spreads past Node.js to Python, Envoy, Istio and Bun

  • The memory bug first patched in Node.js on October 21 lives in Google's Brotli decoder, and Python, Envoy, Istio and Bun now ship fixes too.

What you can do with this

Run node --version and pip show brotli brotlicffi inside every image you deploy. Move to Node 22.23.4, 24.22.1 or 26.12.1 and Brotli 1.2.1, then rebuild.

Read the full piece
Guide Automation

On 10 sample invoices we made, two free tools read 55 of 58 line items, all but the scan.

PDF invoices to Excel: free tools tested, paid APIs priced

  • Amazon, Microsoft and Google sell invoice extraction for 1 to 10 cents a one-page invoice, and find the number and total without label rules.

What you can do with this

If your invoices are digital PDFs from a few suppliers, run the script in this guide and check that each invoice's lines add up to its total. Send every mismatch to a person.

Read the full piece
News AI

OpenAI's Decisions API charges nothing for output tokens and claims answers about 10x faster than the Responses API.

OpenAI Decisions API leaves beta with no charge for output

  • The API left beta on October 22. It runs only gpt-6-luna, takes text, images and JSON, and returns probabilities and choices rather than free text.

What you can do with this

If you run a yes-or-no or pick-one classifier on gpt-6-luna today, price one day of its traffic on both endpoints. Decisions saves the output fee, but it cannot read files or audio.

Read the full piece
Analysis Automation

Self-hosted n8n is free for a business whose own people build the workflows, consultants charging clients included.

Self-hosted n8n is free while only staff build the workflows

  • The license bars hosting n8n for clients who build their own workflows, embedding a workflow builder in a product, and white-labeling it.
  • Sharing, SSO, Git and environments need a paid key. Business showed at 667 euros a month; a 2 GiB server costs $12.

What you can do with this

Write down who will open the n8n editor before you install. If all of them work for you, self-host for free; if clients must build workflows, email license@n8n.io first.

Read the full piece
News Work software

Arc stops opening on Mac and Windows on December 22, and account data is deleted within 30 days after.

Arc browser stops working December 22; export keeps only links

  • The Browser Company is ending Arc to put its security team on Dia, its newer browser, which imports Arc's passwords and extensions.

What you can do with this

If you use Arc for work, import it into Dia or move your passwords to another manager before December 22. Arc's own export saves only tab links, not logins.

Read the full piece
Analysis Automation

Office Scripts runs in Excel on the web and in Power Automate flows, and VBA runs in neither.

Office Scripts vs VBA: what each can still do in 2026

  • VBA still reaches Outlook, Word, files and DLLs. Office Scripts sees only the workbook, and flows allow 1,600 Run script calls per user a day.
  • Windows blocks macros in internet files by default, and VBScript, which some macros call, will be turned off by default around 2026 or 2027.

What you can do with this

Ask of each macro: does it touch anything outside the workbook? Keep those in VBA. Move the workbook-only jobs that need a browser or a schedule, and search for VBScript.RegExp.

Read the full piece
News Developer tools

eMudhra is leaving web certificates five days after a researcher showed anyone could recover eight of its CA keys.

eMudhra quits TLS after key flaw; old trust stores still at risk

  • Chrome, Firefox, Apple and Microsoft block the eight CAs, but tools that skip revocation checks can still trust them until their CA bundles update.

What you can do with this

Update ca-certificates, Node.js, Java, Go, Python certifi and Docker Desktop to the fixed versions, then rebuild container images. That closes a path for forged certificates against your services.

Read the full piece
Guide Automation

Gmail's built-in mail merge sends the same attachment to everyone and can't put a name in the subject line.

Mail merge from Google Sheets to Gmail, with a PDF for each row

  • Our Apps Script turns each sheet row into its own PDF and Gmail message, then marks the row so a second run skips it.
  • We tested it on 5 invented rows with stand-ins for Google's services in Node.js, not in a live Google account.

What you can do with this

Before a real send, set testTo to your own address and run the script once. You get up to 3 sample emails to check, and the sheet stays untouched.

Read the full piece
News Developer tools

GitLab rated a new regex flaw 10.0: anyone, without logging in, could run code on a self-managed server.

GitLab CVSS 10 flaw hits every release since 7.0; patch again

  • GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 on October 21; the flaw reaches back to version 7.0.

What you can do with this

Check your version under Help > Help and upgrade to the fixed release for your line today. If you patched on October 12, upgrade again: that release does not cover this flaw.

Read the full piece
Analysis Automation

A daily digest would use 8 of Apps Script's 1,500 email recipients and 5 of Power Automate's 6,000 actions.

Google Apps Script vs Power Automate: limits and prices compared

  • Both come free with the suite: Apps Script with any Gmail account, Power Automate's standard connectors with Microsoft 365 plans.
  • Power Automate's Google Sheets connector has no trigger, and Apps Script reaches Microsoft only through Graph code and an app registration.

What you can do with this

Write down what starts the job before you pick. If it starts in Google, use Apps Script; if in Outlook, use Power Automate. Either way, name a second owner.

Read the full piece
News Developer tools

PHP says there are no complete mitigations for its two critical flaws: updating is the only safe choice.

PHP fixes are out: 8.5.12, 8.4.27, 8.3.36 and 8.2.35

  • PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that can allow remote code execution without a login.

What you can do with this

Update PHP today, or ask your host to. On Ubuntu, check the package version with dpkg, not php -v, because Ubuntu backports the fix into older version numbers.

Read the full piece
Analysis Automation

France's Conseil d'État cut Amazon's monitoring fine to 15 million euros; keeping every indicator 31 days still broke the rules.

Employee monitoring and GDPR: why consent fails and what works

  • Regulators in the EU, UK and Sweden say employee consent rarely works, so recording work usually rests on legitimate interest and an impact assessment.
  • In 2024 the CNIL fined a small firm 40,000 euros for idle-time tracking and screenshots every 3 to 15 minutes.

What you can do with this

Before recording anyone, write a legitimate interest assessment and a DPIA, tell staff in writing, and collect group-level data without keystrokes or screenshots. The fined French firm missed the DPIA and the written notice.

Read the full piece
News Developer tools

PHP fixes two critical flaws at 14:00 UTC today, but about a third of PHP sites run unsupported versions.

PHP patches two critical bugs today; 8.1 and older get no fix

  • Both bugs are rated 9.2 of 10 and may allow remote code execution. Details leaked on Tuesday, before the planned release.

What you can do with this

Run php -v on every server, or ask your host which PHP version your sites use. If it is 8.2 or newer, book the update for 14:00 UTC; if older, ask for a backport today.

Read the full piece
News AI

Gemini's new business tools take your receipts, but on a personal account some chats may go to human reviewers.

Gemini small-business hub: which account keeps receipts private

  • Google announced a Gemini business page with finance skills and apps such as Shopify and Xero, rolling out to all Gemini users soon.

What you can do with this

Before you upload receipts or connect Xero, open Gemini under a Google Workspace account, or turn Keep Activity off on a personal one. Your books then stay out of model training.

Read the full piece
News Developer tools

A power event in one Google Cloud zone in London led to almost eight hours of trouble across 38 products.

Google Cloud London outage: one-zone power event hit 38 products

  • Revolut's services were disrupted for hours, and Google reported errors elsewhere in the europe-west2 region, not only in the zone that lost power.

What you can do with this

List which of your systems and vendors run in europe-west2, and keep spare capacity running in a second zone. Creating it mid-outage may fail, as Google warned on Tuesday.

Read the full piece
Analysis Automation

At an assumed hour a month of upkeep, 5 of 7 tasks in our recomputed xkcd table never pay back.

xkcd's automation table, recomputed with upkeep counted

  • xkcd 1205 counts 24-hour days, 365-day years and no upkeep; we redid it for a 260-day working year and subtracted fixes.

What you can do with this

Before you build, multiply minutes saved by runs a year and compare it with the upkeep you expect. If upkeep is larger, do it by hand or keep it a throwaway script.

Read the full piece
Analysis Automation

At 10,000 runs a month, the same lead workflow costs $289 on Zapier and $50 on n8n Cloud, billed yearly.

Zapier, Make and n8n priced for one workflow at 10,000 runs

  • Zapier bills every action, Make bills every module including the trigger, and n8n bills one execution per run however many steps it has.
  • Self-hosted n8n has no run quota. On our large sandbox machine it peaked at 884 MiB, so we would pick a 2 GiB server.

What you can do with this

Count the action steps in your workflow and multiply by your monthly runs before you pick a plan. Add 25% headroom, because Make and n8n Cloud pause workflows when the allowance runs out.

Read the full piece
Analysis Automation

EU regulators called software that logs keystrokes and captures screens disproportionate for employers in 2017.

Task mining vs process mining: logs are cheap, screens are risky

  • Process mining rebuilds a process from timestamped system logs; task mining records clicks, keystrokes and often screenshots on a person's desktop.
  • On a 60-invoice sample log we built, 23 lines of free Python found the rework loop and the slowest wait.

What you can do with this

Export one process as a CSV with case ID, activity and timestamp, then mine it before buying anything. If you need click-level detail, have one volunteer record one task they choose.

Read the full piece
Guide Automation

In our stand-in test, a label-per-thread script missed 2 of 13 sample form emails and wrote 4 rows wrong.

Gmail to Google Sheets automatically, with and without code

  • Gmail gives scripts whole conversations, so labeling a thread hides or duplicates its next email. We tested outside live Gmail.
  • A free 96-line script that records each message ID, Zapier, or Workspace Studio can fill the sheet, each with its own limits.

What you can do with this

Paste the script into Extensions, Apps Script, set the sender and labels, and run setup. Then send your form to yourself twice, once without a phone, and check for two rows.

Read the full piece
Guide Automation

In our worked example, a monthly task looked like a 19-month payback until upkeep was counted; then it never paid.

Automation payback: a formula that counts the time to fix it

  • Our tested template adds yearly upkeep and failure hours to the usual sum, priced at $36.63 an hour for a median bookkeeping clerk.

What you can do with this

Before building an automation, fill in the template with your numbers and log every fix. If payback reads never, simplify or skip it and keep the build hours.

Read the full piece
Guide Automation

In our emulation, the tutorial email-to-Excel recipe failed on 8 of 20 test emails and botched 4 more.

Email data into Excel automatically: three methods tested

  • It splits the text on labels like Name:, so a table layout, a renamed label or a missing field breaks it.
  • An 85-line Python script and an AI prompt each read all 100 fields, with their own limits.

What you can do with this

Build one flow per sender format with the guarded expression below, add a Missing column, and check it weekly. Rows that break then show up instead of disappearing.

Read the full piece
News AI

Cloudflare's new Clairic model charges only for input: $0.10 per million tokens, with no output fee.

Cloudflare's Clairic reads invoices for $0.10 per million tokens

  • Clairic, a preview on Workers AI, pulls typed fields such as totals and due dates out of text and images, each with a confidence score.

What you can do with this

Run 20 of your own invoices through the free tier and compare each field with what you typed by hand. Route anything below your confidence cutoff to a person before it touches payments.

Read the full piece
Guide Automation

Saving every attachment under its own name lost two of three invoices in our 12-email test.

Outlook attachments saved automatically: three ways, no VBA

  • Outlook rules can't save attachments, and the new Outlook for Windows doesn't support VBA.
  • A free cloud flow, Power Automate for desktop or a 56-line Python script can, with an inline filter and unique file names.

What you can do with this

If your office uses Microsoft 365, build the cloud flow with an Is Inline filter and a date-plus-guid file name. New attachments then land in OneDrive without logos or overwrites.

Read the full piece
Analysis AI

At Anthropic, interactive Claude sessions spend about 80% of their time idle, waiting for a person to respond.

Anthropic's AI agents wait on people 80% of the time

  • An October 16 Anthropic report finds its agents work six times the hours of the staff directing them; reading their output is the bottleneck.

What you can do with this

Before you add agents, estimate the reading load: output tokens times 0.75, divided by 250 words a minute. You see the review hours the agents will cost before you commit to them.

Read the full piece
News Developer tools

Cloudflare's own docs now tell new projects to start on Workers, not Pages.

Cloudflare sends new projects to Workers; static sites stay free

  • Pages keeps running, but Cloudflare's feature work now goes to Workers.
  • Static files stay free on Workers, but a custom domain can only move if Cloudflare runs its DNS.

What you can do with this

If you start a site now, create it as a Worker, not a Pages project. Static hosting stays free, and you skip a migration later.

Read the full piece
Analysis Work software

Knight Capital lost more than $460 million in about 45 minutes, after 97 warning emails nobody acted on.

Boring tools win: five tests before a small team buys automation

  • Knight Capital, the Post Office and CrowdStrike failed the same way: automation nobody could read or stop.
  • People stop checking systems that are usually right; in one study they caught only 33% of misses.

What you can do with this

Feed any workflow tool a missing field, a duplicate record and a wrong file format before you sign. If it does not stop and tell a named person, keep it away from money.

Read the full piece
Guide AI

In Microsoft's survey, 78% of people who use AI at work bring their own tools; at smaller firms, 80%.

Choosing an AI assistant: 6 vendor questions and a 2-week trial

  • One vendor can write very different rules for personal and business accounts, from training on chats to how long they are kept.
  • The guide gives six questions to put to vendors in writing, and a two-week trial on real work.

What you can do with this

Send each shortlisted vendor the six questions in writing, starting with whether your data trains their models. You get answers tied to a contract or a setting, not a sales-call promise.

Read the full piece
Guide Automation

If your team uses Google Workspace or Microsoft 365, a scheduler that sends the weekly report already comes with it.

Weekly reports can send themselves: 9 steps, little or no code

  • Setting the timer is easy; reports break later because a schedule runs on one person's login or fires at a random minute.
  • A broken automated report rarely looks broken. It looks like a quiet week.

What you can do with this

Put a check cell beside each key number that flags a week with no data, and include it in the email. A failed import then reaches everyone instead of passing as a quiet week.

Read the full piece
Analysis Automation

People's estimates of their own screen time matched device logs within 5% in only 3 of 49 comparisons.

Office tasks worth automating hide in habits; a tally finds them

  • About 43% of what students logged in a 2002 diary study were habits, done with their minds more often elsewhere.
  • So asking a team what to automate tends to miss the small, frequent tasks that make the best first projects.

What you can do with this

Have one volunteer keep a tally sheet by the keyboard for five days, with a tick each time a task repeats. You get counts instead of guesses, and a clear first task to automate.

Read the full piece
Analysis Developer tools

In 2017 GitLab lost about six hours of data: its backups had been failing, and the alert emails bounced.

Scheduled scripts fail silently; seven checks make them speak up

  • In a 34-line invoice script, two lines find the late invoices; the rest of the work is making sure a failure reaches a person.
  • A scheduled script runs where nobody watches, so a failure stays silent unless someone builds it a voice.

What you can do with this

Add a ping after each successful run to a dead man's switch on another machine, such as Healthchecks.io's free plan. If the script fails or stops running, you get an alert.

Read the full piece

You are all caught up

Every article and note, as a plain list: