WordPress 7.1 “Mary Lou” shipped on 19 August 2026, and one line in the developer notes matters more than the rest of the release combined: the post editor is now always iframed. Not iframed when your theme is block-based. Not iframed when every block in the content declares a modern API version. Always. The advice…

Intercom charges $0.99 every time Fin resolves a conversation. Tidio charges roughly $0.65 for every conversation Lyro replies to at all. Both numbers come straight off the vendors’ own pricing pages, and both are perfectly defensible prices for a finished product. What almost nobody puts next to them is the raw cost of the thing…

WordPress 7.1 “Mary Lou” shipped on 19 August 2026, and the release coverage has settled on the same three things: tabs, the playlist block, and native responsive styling. Those are real. They are also not the change most likely to affect you if you run an AI chatbot, an MCP server, or any plugin that…

On 1 September 2026, WooCommerce 11.1 ships a page that any visitor can open without logging in, fill in with a name, an email address and an order number, and submit. It is called the order withdrawal form, it lives at /my-account/withdraw-order/, and the pre-release notes describe it in three words that will make any…

A team from UC Santa Barbara pointed a scanner at 17 third-party AI chatbot plugins — the drop-in chat widgets sitting on more than 10,000 public websites — and checked whether the text a visitor controls can be turned into instructions the model obeys. Eight of the 17 accepted a completely forged conversation history from…

A visitor asked my chatbot a question this week. The question was 34 characters long. To answer it, the site sent just under 15,000 characters to the model. That ratio is the whole economics of a self-hosted AI chatbot, and almost nobody publishing pricing advice has measured it on a real install. So I did…

On 12 August 2026, an advisory landed for WooCommerce Subscriptions: unauthenticated PHP object injection, escalating to remote code execution, in every version below 9.1.0. The trigger condition is the interesting part — it applies when High-Performance Order Storage is switched on. HPOS is switched on here. So before writing anything about it, I ran the…

Verified — 20 August 2026, against the shipped release: Guidelines is not in WordPress 7.1. This post said the Guidelines feature appeared in the June roadmap, was absent from the August Field Guide, and that secondary coverage contradicted itself — and it declined to call the outcome. Here is the outcome, checked rather than read…

WordPress 7.0.4 patches an Author+ RCE. Our automatic updates were enabled and it still never installed. Here is the measurement, and the 30-second check.

Between 31 July and 13 August 2026, this site logged 157,619 requests. About 5% of them claimed to be an AI crawler — GPTBot, ClaudeBot, PerplexityBot, ChatGPT-User, OAI-SearchBot. We checked each one against the IP ranges the vendors publish themselves. Forty-six percent were not who they said they were. That number matters because “how much…