Uncategorized

In May 2026, two security teams pointed an automated pipeline at the WordPress plugin repository and came back with more than 300 critical zero-days in 72 hours of scanning. The average cost worked out at roughly $20 per vulnerability. This week I ran wp plugin list –update=available against my own site and found eight plugins…

There is a date being repeated across a lot of accessibility content right now, and it is wrong. It is April 24, 2026 — the ADA Title II web compliance deadline. It moved four months ago, and a surprising number of “2026 compliance checklist” articles have not caught up. That sent me looking at our…

Buried in the AI Engine changelog for version 3.7.2, shipped on 20 August, is a one-line security note that deserves more attention than a changelog gives it: “A crafted URL could escape the uploads folder and send any server-readable file to the AI provider.” Read that again slowly, because the interesting word is send. This…

For about a year now the standard advice has been that AI assistants are quietly becoming a traffic source, and that you should be optimising for them. The advice is everywhere. The measurement almost never is. So I measured it on this site. I pulled every query Google Search Console would disclose for mxchat.ai over…

On 13 August Google shipped Gemini 3.7 Flash and cut the price in half. That is the headline everyone ran. The part almost nobody ran is printed on the same page, in the same table, one line down: the cut expires on 31 December 2026, and on 1 January the price doubles. Update, 24 September…

WordPress 7.1 “Mary Lou” shipped on 19 August 2026, and one line in the developer notes matters more than the rest of the release combined: the post editor is now always iframed. Not iframed when your theme is block-based. Not iframed when every block in the content declares a modern API version. Always. The advice…

Intercom charges $0.99 every time Fin resolves a conversation. Tidio charges roughly $0.65 for every conversation Lyro replies to at all. Both numbers come straight off the vendors’ own pricing pages, and both are perfectly defensible prices for a finished product. What almost nobody puts next to them is the raw cost of the thing…

WordPress 7.1 “Mary Lou” shipped on 19 August 2026, and the release coverage has settled on the same three things: tabs, the playlist block, and native responsive styling. Those are real. They are also not the change most likely to affect you if you run an AI chatbot, an MCP server, or any plugin that…

On 1 September 2026, WooCommerce 11.1 ships a page that any visitor can open without logging in, fill in with a name, an email address and an order number, and submit. It is called the order withdrawal form, it lives at /my-account/withdraw-order/, and the pre-release notes describe it in three words that will make any…

A team from UC Santa Barbara pointed a scanner at 17 third-party AI chatbot plugins — the drop-in chat widgets sitting on more than 10,000 public websites — and checked whether the text a visitor controls can be turned into instructions the model obeys. Eight of the 17 accepted a completely forged conversation history from…