Uncategorized

A team from UC Santa Barbara pointed a scanner at 17 third-party AI chatbot plugins — the drop-in chat widgets sitting on more than 10,000 public websites — and checked whether the text a visitor controls can be turned into instructions the model obeys. Eight of the 17 accepted a completely forged conversation history from…

A visitor asked my chatbot a question this week. The question was 34 characters long. To answer it, the site sent just under 15,000 characters to the model. That ratio is the whole economics of a self-hosted AI chatbot, and almost nobody publishing pricing advice has measured it on a real install. So I did…

On 12 August 2026, an advisory landed for WooCommerce Subscriptions: unauthenticated PHP object injection, escalating to remote code execution, in every version below 9.1.0. The trigger condition is the interesting part — it applies when High-Performance Order Storage is switched on. HPOS is switched on here. So before writing anything about it, I ran the…

WordPress 7.1 ships on 19 August 2026. If you have read anything about its AI features in the last month, you have probably read about Guidelines — a place in core to write down your brand voice and editorial rules once, so every AI tool on the site can read them instead of you re-explaining…

WordPress 7.0.4 patches an Author+ RCE. Our automatic updates were enabled and it still never installed. Here is the measurement, and the 30-second check.

Between 31 July and 13 August 2026, this site logged 157,619 requests. About 5% of them claimed to be an AI crawler — GPTBot, ClaudeBot, PerplexityBot, ChatGPT-User, OAI-SearchBot. We checked each one against the IP ranges the vendors publish themselves. Forty-six percent were not who they said they were. That number matters because “how much…

There is a setting in our chatbot’s admin screen that says transcripts are deleted after one month. It is set. It has been set for a long time. This morning I checked whether it actually happens, and the honest answer is that the job responsible for it last ran on 9 August and is not…

WordPress now runs an AI security review over plugin and theme updates before they reach your site, and holds each release for a cooldown period first. It is called Protect The Shire, it has been live since June, and it is a genuinely good idea. This morning I pointed it at my own install and…

On 1 September 2026, Claude Sonnet 5 stops costing $2 per million input tokens and starts costing $3. Output goes from $10 to $15. Anthropic’s pricing documentation is explicit about it: “Introductory pricing of $2/$10 per million input/output tokens is in effect through August 31, 2026, after which the standard pricing of $3/$15 per million…

One article of the EU Cyber Resilience Act starts applying on 11 September 2026, and it lands on commercial WordPress plugin vendors — including free plugins with a Pro tier.