In this edition of the Flying Point Update, we’re going to talk about AI and the software holding up the internet, the retirement accounts you open on your own, and Asian lady beetles.
Top of Mind
A few weeks ago, a story broke that I suspect most people scrolled right past. I certainly did, until one of my more tech-savvy clients explained the issue to me. Security researchers announced they had found serious flaws in something called PHP. Most of us have never heard of it, but it runs behind the scenes on roughly 70% of the world’s websites. The flaws had been sitting in the code for more than a decade, and they could have let an attacker take over a website’s server from the outside, no password required. The researchers found them with the help of AI.
The fix went out on October 21st, and by most accounts it was handled responsibly. The researchers worked quietly with the people who maintain PHP for weeks before announcing anything. Even so, word got out before everyone had patched, and attackers started trying their luck. The part that stuck with me is that a piece of the problem had actually been spotted back in 2024 and set aside, because nobody could figure out how to exploit it. When researchers pointed AI at it this summer, it found a way in about two days.
I’ll admit this one got my attention. I use AI tools in my own work, and I’m a pretty ordinary user. I type a question, I get an answer, and I have only a vague sense of what happens in between. The same goes for most of the technology my life runs on. I couldn’t tell you what my bank’s website is built on, or how many other systems it quietly talks to. I did check, and since this website runs on Squarespace, there was nothing on my end to patch.
What strikes me is that the same tools cut both ways. AI found a decade-old problem in a matter of weeks, which means someone with worse intentions could have found it just as fast. It also means the fix came faster than it would have otherwise. One detail I keep coming back to: the nonprofit that maintains PHP, the software underneath most of the internet, has about a dozen people on staff.
To be clear, I don’t think Skynet is looming. If anything, it reminds me more of Solaris, Stanisław Lem’s classic sci-fi novel about generations of scientists studying an intelligent ocean on a distant planet, and never quite figuring out what it is. The ocean isn’t hostile, exactly. It just stays beyond them. I suspect AI will stay a little beyond me, too. In the meantime, it feels like an arms race that suddenly picked up speed on both sides. For my part, it’s made me a little more deliberate about the boring stuff: updates, passwords, and how documents move between me and the people who trust me with them.
Worth Knowing
Two issues ago, in Retirement Accounts and Woodchucks, we sorted retirement accounts into three buckets based on who set up the account. Last issue, Workplace Retirement Plans and Canada Geese, covered bucket one. This week is bucket two: accounts you open on your own, meaning the traditional IRA and the Roth IRA.
These sit entirely outside your job. You can open one at any brokerage, you move the money in yourself, and the IRA limit is separate from your 401(k) limit. Plenty of people contribute to both.
There are two ground rules. First, you need earned income, meaning wages or self-employment income, and you can’t contribute more than you earned. (A married couple filing jointly can use one spouse’s earnings to fund an IRA for a spouse who isn’t working.) Second, there’s one limit shared across all your IRAs. For 2026, that’s $7,500, or $8,600 if you’re 50 or older. You can split it between traditional and Roth, but you can’t put $7,500 in each.
Traditional IRA. Anyone with earned income can contribute, at any age. The real question is whether you get a deduction. If neither you nor your spouse is covered by a retirement plan at work, the answer is yes, at any income. If you are covered, the deduction shrinks and then disappears as your income rises.
Here’s how that works. Say you’re single, you have a 401(k) at work, and your modified adjusted gross income is $85,000. For 2026, the deduction phases out between $81,000 and $91,000 for someone in your position. You’re 40% of the way through that range, so you lose 40% of the deduction. Contribute $7,500 and you can deduct $4,500. The other $3,000 is still allowed. It just goes in after tax, and it gets tracked on a form called 8606 so you aren’t taxed on it a second time when it comes out. Hang on to those forms. (Married couples have their own ranges, including a more generous one when only one spouse is covered at work.)
Roth IRA. This is the reverse. There’s no deduction now, but qualified withdrawals in retirement are tax-free. Here the income limit decides whether you can contribute at all. For 2026, it starts phasing out at $153,000 of modified AGI for single filers and $242,000 for joint filers. One feature people often miss: the dollars you put in (not the growth) can come back out at any time without tax or penalty. That makes a Roth more flexible than it looks, though I’d still treat it as retirement money.
Timing. Unlike a 401(k), an IRA contribution for 2026 can be made until April 15, 2027. That’s useful, because by then you’ll know your income and can see which of the rules above apply. If you contribute between January and April, make sure your brokerage records it for the right year.
We’ll save the backdoor Roth and Roth conversions for another time. They’re important topics, but outside the scope of this post.
Mark Your Calendar
Thursday, December 31st: Last day for 401(k) and other workplace plan contributions through payroll, Roth conversions, and required minimum distributions if you’re already taking them.
Friday, January 15th, 2027: Q4 2026 estimated tax payments are due.
This quiet stretch before year end is a good time to review estimated tax payments and projections.
Maine Wildlife Facts
Every year, right around Halloween, the same thing happens in our upstairs hallway. There’s one spot by a south facing window that catches a lot of sun, and over a few days it fills up with lady beetles, crawling along the trim and up the wall. Cat, our team entomologist, loves them. She checks on them most mornings and considers them hers.
These are multicolored Asian lady beetles. They look like ladybugs, and technically they are, but they aren’t from here. They were released in the U.S. on purpose, many times starting as early as 1916, to help control aphids and other pests. They’re good at the job, and today they’re among the most common of the nearly 60 lady beetle species in Maine. You can tell them from native species by a black mark shaped like a W (or an M, depending on which way you’re looking) just behind the head.
Their other name is the Halloween lady beetle, because late October is when they start moving indoors. In their native range in Asia, they spend the winter packed into cliffs and rock outcrops. In Maine, a house is apparently the next best thing. They’re drawn to sunny, light-colored walls, especially ones facing south and west, and once they land, they hunt for any crack that leads somewhere warm. Most native lady beetles spend the winter outdoors, under bark or in leaf litter. The Asian ones prefer a crowd, which explains our hallway.
They aren’t there to cause trouble. They don’t eat anything in the house or breed indoors. They’re just waiting out the winter. If they’re squished or handled roughly, though, they release a yellowish fluid that smells bad and can stain walls and fabric, so the official team policy is gentle hands and a cup for relocation. In spring, the survivors head back outside to eat aphids and lay their eggs on leaves.
Cat is hoping they stay until spring. Given the location, they probably will.
These Maine wildlife facts have been brought to you by Will (8), Frank (4), and Catherine (2), Flying Point Advisors’ on-staff naturalists.
Questions about any of this? Just reach out - I read every email and love hearing from you.
Thanks for reading. You’ll hear from me again in about two or three weeks.
-Mike
Disclaimer
The Flying Point Update is provided for general educational and informational purposes only. The content in this newsletter reflects my thoughts and observations on tax, accounting, and financial planning topics, but should not be considered personalized tax, accounting, or investment advice for your specific situation.
Tax laws are complex and change frequently. The information presented here is based on current tax law as of the publication date and represents general concepts that may not apply to your circumstances. Every individual and business has unique factors that affect their optimal tax and financial planning strategies.
Before making any financial decisions or implementing any tax strategies discussed in this newsletter, please consult with a qualified tax professional, CPA, or financial advisor who can evaluate your specific situation. If you’d like to discuss how any of these topics might apply to your circumstances, I’m always happy to chat.