Beginner
Jetpack ships a critical security fix
Jetpack 16.1.3 patches a critical vulnerability, and the team is urging every site to update right away even though there is no sign of exploitation yet. Given Jetpack's reach, this is a five-minute job worth doing before you read any further.
How AI decides whether to cite your brand
People increasingly ask an LLM whether a brand is trustworthy instead of searching its name, which changes what earns you a mention. Kinsta looks at the signals that make AI models cite you, and why that is becoming its own discipline.
A plain guide to fixing slow clicks
Interaction to Next Paint measures the lag between a click and the page responding, and it is now a ranking signal your visitors can feel. Themeisle explains how to test it on your WordPress site and the fixes that move the number.
Developer
Elementor Pro is now under active attack
The critical file-upload flaw in Elementor Pro, on more than six million sites, is now being exploited in the wild. Anyone who deferred the August patch should update today and check for unfamiliar files and new admin users.
A 5-million-site SQL injection in All-in-One WP Migration
One of the most installed migration plugins carries an unauthenticated SQL injection that reaches roughly five million sites. Patch it now, since a backup and migration tool is exactly the kind of high-privilege code attackers love to find unpatched.
WooCommerce swaps magic strings for real constants
WooCommerce core now ships named, documented constants for order statuses, product types, stock states, and more, instead of loose strings scattered through the code. Extension authors get far less brittle integrations by adopting them.
Runnable code examples land in the WordPress docs
The Code Reference now runs live examples in the browser through WordPress Playground, starting with the first two in 7.1 and more coming in 7.2. A small but real step toward docs you can try instead of only read.
Business
Fewer clients, or more of them?
The WP Minute weighs the classic agency trade-off: a handful of high-value clients against many smaller ones on recurring plans. Kurt and Toby use real numbers from their own work, which makes it more useful than the usual hot takes.
The one check to run before a WooCommerce sale
Prepping a store for a sale usually means poking at caching, PHP version, and last night's backup one at a time. Pressable shows how a single prompt can run the whole pre-sale checklist through MCP, a neat and concrete use of AI in hosting.
The questions that reveal a good agency
A polished pitch and a wall of client logos tell you almost nothing about how a build will really go. Human Made lists the questions that surface how an agency works before you sign, not months after.
Non-WordPress
A dark-web service is selling 153 million licenses
A new identity-theft service is hawking scans of more than 153 million US and Canadian drivers licenses, and the FBI is now investigating. A stark reminder of how much verified identity data is already loose in the wild.
Cloudflare and OpenAI turn WAF data into patches
Cloudflare's new Managed Defense pairs live WAF signals with OpenAI models to prioritize real threats, stage edge mitigations, and even propose code fixes. It is the same find-and-fix-with-AI pattern behind this week's WordPress security news, now at network scale.
Bringing CSS random() to every browser
The upcoming CSS random() function is a fun addition, and this walks through polyfilling it so you can use it before browsers catch up. A lighter read to end on after a heavy security week.