The WP Week Newsletter

Curated updates for agencies, developers, and serious WordPress users. Delivered weekly.

✉️ View Latest Issue 📨 View Archive

#294 – PHP2Shell Patched, WC India 2027 Host City, Automattic Layoffs, MCP to Core, WP 7.2 Beta

Issue #294   |   October 27, 2026   |   Reading time: 21 mins

Hello!

This week on The WP Week Newsletter, we cover the PHP2Shell vulnerability and the patch, the recent layoffs at Automattic, plans to move MCP into Core, Jetpack’s new public feature board, along with new projects and more.

Submissions are now open for Black Friday 2026! Share your deals on plugins, themes, hosting, WooCommerce tools, SaaS, and more.

Don’t forget to subscribe and listen to the podcast version of this newsletter, where you can hear more details and discussions about these topics and more.

New around here? Don’t miss the next issue, sign up now. Got something to share – connect with us.

See you next week!

Team WP-CONTENT.CO

🙌 This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

🗣️TALK OF THE TOWN

PHP has released security updates to address two critical remote code execution vulnerabilities, dubbed “PHP2Shell”, that could allow unauthenticated attackers to execute code on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS severity score of 9.2 out of 10. The PHP project has urged users to update immediately, with fixes available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Mark Maunder, CEO of Wordfence, said Wordfence had not seen any hacked WordPress sites linked to PHP2Shell, despite detecting attack attempts in its telemetry. He called for vulnerability messaging to account for how exploitable and scriptable a flaw is, warning that the current approach risks alert fatigue and loss of credibility.

Two days after the emergency fixes for the critical PHP2Shell flaws, PHP has warned of a new potential code execution vulnerability, CVE-2026-115560. The issue affects applications using an uncommon configuration involving session serialization and upload progress. PHP recommends disabling session upload progress until a fix is available in a routine release. The team has also released updated Windows builds for PHP 8.5, 8.4, 8.3 and 8.2, incorporating Brotli 1.2.1 to fix an out-of-bounds write vulnerability (CVE-2026-111497).

📰  WORDPRESS & AROUND

All the updates around WordPress and its closely related technologies

Contributors are exploring how to make the Model Context Protocol (MCP) a built-in part of the WordPress experience after Matt approved moving ahead with the initiative.

🔧 TIP OF THE WEEK

Use wp_unique_id() for Repeated ACF Blocks

ACF blocks can appear multiple times on the same page.

This can create duplicate IDs:

<div id=”accordion”>

Instead:

$id = wp_unique_id(‘accordion-‘);

Output:

<div id=”accordion-1″>

Another block gets:

<div id=”accordion-2″>

Very useful for:

  • Accordions
  • Tabs
  • Modals
  • Sliders
  • aria-controls

👥 COMMUNITY NEWS

Updates and News from the WordPress Community

Chetan Prajapati (WordCamp Asia 2025 organizer and organizer of the WordPress Ahmedabad Meetup and WordCamp Ahmedabad) shared the announcement on X, and the event will be the fourth flagship WordCamp globally, following WordCamp US, WordCamp Europe and WordCamp Asia.

  • Sam Parr questions the future of WordPress theme and plugin businesses amid AI adoption: The longtime WordPress user said he still uses the platform but relies on Claude to handle everything for him. He questioned whether theme and plugin businesses are becoming unnecessary and asked whether others are continuing to use WordPress or building their own websites.
  • Hostinger cuts server response times by up to 35% without expanding infrastructure: They have reduced average server response times by 26% after optimizing its in-house CDN, with SSD-based hosting servers seeing improvements of up to 35%. The optimizations cut CDN computing resource requirements by 45–50%, allowing Hostinger to offer the CDN across all web hosting plans at no additional cost.
  • Jeff Starr questions WP Ghost’s use of the 9G Firewall name: Starr has been developing the free, open-source nG-series firewall for many years and is currently working on 9G, with 8G remaining the latest public version. He says the firewall advertised in the WP Ghost plugin is not his creation and has asked the developers to clarify their use of the name and whether they intend to take over development of the nG project without his permission.
  • Scanfully seeks beta testers for its new WooCommerce monitoring feature: Remkus de Vries is inviting people who run WooCommerce stores for themselves or clients to test the new feature and provide feedback.
  • WPZOOM takes over WPBruiser and brings the plugin back with new features: After years without updates, WPBruiser has returned to the WordPress.org plugin directory under WPZOOM’s maintenance, with security fixes, compatibility improvements, and new features in the free version. WPBruiser Pro also returns as a single add-on, bringing back the original premium features.
  • Akismet marks its 21st anniversary with new tools for Drupal and PHP developers: Launched in October 2005, Akismet has blocked more than 570 billion pieces of spam. Its new official Drupal module and PHP SDK extend spam protection beyond WordPress, while updates to its WordPress plugin improve accessibility, automated submission detection, and compatibility.
  • GeneratePress restructures its pricing plans: The new pricing structure offers three site options covering 1, 10 or 100 sites under GeneratePress One, combining GP Premium, GenerateBlocks Pro, GenerateCloud and all future products in a single license. Every plan includes updates while the license is active and priority email support. The changes introduce a new plan for single-site users, while existing customers can retain their current licenses, pricing and site limits.
  • Jetpack launches a public feature request board: Adam Pickering explains how users can submit and vote on feature requests, follow their progress, and receive email updates as requests move through review, planning, development, and release. Users can access the board with their WordPress.com accounts.
  • SureForms 2.12.9 adds abandoned form reminders and one-click MCP Adapter setup: The update adds reminder emails for visitors who leave forms unfinished, clearer warnings and logs for failed notifications, and expiring, revocable resume links for partial entries. The update also fixes issues affecting form submissions, accessibility, payments, integrations, and Save & Resume.
  • FlowMattic 7.3 introduces FlowMattic Cloud and expands its MCP Server: The new FlowMattic Cloud add-on brings scheduling, webhook delivery with retries, and FlowMattic Tables under one account. The release also adds 21 WordPress abilities to the MCP Server for use by compatible plugins and AI clients, and more.
  • Novamira Pro adds AI specializations for Ollie and MyListing: The new specializations help AI agents work with Ollie’s block theme structure and editor extensions, and configure MyListing directories, listing types, entries, and taxonomy terms. Each specialization includes a companion skill to guide the agent through the relevant workflows, with support requiring specific minimum versions of the themes.
  • CSS-Tricks returns to independent ownership under Geoff Graham: Graham plans to focus on community building and developing an HTML/CSS course for beginners, while bringing back the newsletter and continuing to publish articles. The site will also use advertising, memberships and its shop to support its operations.
  • Vulnocalypse tracks and verifies emerging security vulnerabilities worldwide:  The live tracker monitors vulnerability disclosures, government advisories, research reports and news coverage across more than 200 countries.
🚀 NEW PROJECTS
“I love to hear what you think and if you find it helpful.”

Ellen Bauer about creating Tweakfast.
  • Tweakfast: A new tool by Ellen Bauer, built as an experiment for Spacefast, lets owners edit plain HTML websites directly in their browser without logging in or installing anything. Owners receive a single link to edit the website, where they can change text, images, layouts, links, and pages.
  • InstaWP Studio: A new project by Vikas Singhal that allows users to build WordPress websites by describing the business, target audience, desired look, and goals. Users can start from a description, bring over an existing website for a WordPress rebuild, choose from six templates, or begin with a blank site.
  • That’s Done: The plugin by TricaExMachina that lets clients review websites by clicking elements to leave comments, draw annotations, or approve changes without creating an account. It includes before-and-after screenshots, team feedback management, multi-device testing, branded sign-off reports, and integrations with tools such as Slack, Zapier, and Make.
  • Maintenance Art: A new platform by Dan Knauss dedicated to recognizing and supporting the maintainers who keep WordPress and open-source software running. It encourages people to thank maintainers, contribute to their work, or provide financial support for ongoing maintenance.
  • PhotoFetch plugin: It adds a search and import interface for the WordPress Photo Directory to the Media Library and the editor’s media chooser, letting users find and import photos without leaving WordPress. It was developed by contributors during WordCamp US 2026 Contributor Day.
  • HostlessWP: A command-line tool that deploys existing WordPress sites to Cloudflare Workers while keeping their themes, plugins, and dynamic features intact.
  • Bulk Search & Replace for WooCommerce: The new plugin by StackWC lets users find and update text across their entire WooCommerce store products, variations, media, categories, attributes, coupons, orders, and customers from one screen.
  • Vert: A child theme for Ollie by Brian Gardner.

🔖 INTERESTING READS & PODCASTS

More posts and podcasts from the WordPress Community you don’t want to miss

  • In this episode of Seriously, Bud?, Raitis Sevelis talks about his work at WPBakery, the longstanding WordPress page builder, and how the business is growing again after a downturn. He discusses the company’s 16-person team and credits its success to a combination of product, marketing, sales, and having the right people involved.
  • Chris Hubber in this episode of WP Tavern Jukebox, discusses WordPress’s Data Liberation initiative and the Static Site Importer tool, which converts static HTML and CSS websites into editable WordPress block themes.
  • The Melapress Show features a conversation between Robert Abela and Marcel Tannich about why WP-CLI remains important as AI tools become more capable, covering its uses for troubleshooting, automation, and managing multiple WordPress sites, along with the risks of running AI-generated commands.
  • Equalize Digital partnered with WooCommerce to audit 43 extensions, identify 519 accessibility issues, and verify fixes across 41 extensions to meet WCAG 2.2 Level AA conformance. The project also resulted in 41 published Accessibility Conformance Reports, giving merchants more information about extension accessibility.
  • Courtney Robertson shares her experience using Claude and Accessibility Checker Pro to remediate accessibility issues on her WordPress site, detailing the fixes, AI mistakes, and recurring problems that highlight the need for thorough testing and ongoing accessibility checks.
  • Matt Cromwell explains how he rebuilt Rootsandfruit.com using WordPress locally, Cursor, and Simply Static to publish a static website on Cloudflare Pages for $0 per month.
  • Marcin Dudek examines 16 ways to protect WordPress database credentials, explaining how each method addresses different exposure risks.
  • Dennis Crowley reflects on Foursquare’s 17-year history following its acquisition, which resulted in no payout for shareholders. He discusses his own responsibility, criticizes how the company’s final chapter was handled, and shares lessons for founders on leadership, accountability, and finding closure.
  • Jono Alderson explains why replacing a content management system with AI-generated web pages can create problems when content, metadata, URLs and publishing rules are not connected.
  • Eric Karkovack explores how AI is accelerating the discovery of web security vulnerabilities while also increasing the volume of security warnings and potential threats.

🛠 GUIDE ZONE – HOWTO’S and MORE

Handpicked fresh guides from WordPress circle

📆 SAVE THE DATES

Do not miss a WordPress event ever again

🎁 WORDPRESS DEALS OF THE WEEK

Again, these are the best deals of the week, handpicked by yours!

Running a Black Friday deal? Share it here.

EXCLUSIVE DEALS
  • 4 Months free offer on hosting plans of WP Engine (Coupon Code- FREEDOMTOCREATE)
  • 10% off on monthly & annual plans at SureTriggers (Coupon Code- WPCONTENT10)
  • Up to 84% off at Hostinger (Code NYSALE for an extra 10% off)
  • 15% off yearly plans at Videvo (Coupon Code – WPV15)
MORE DEALS

This weekly newsletter is kindly sponsored by awesome WordPress Companies 🦸‍♂️🙌

ProfilePress – Create membership sites & sell subscriptions on WordPress Check it out  →

Create a career page and start recruiting talents in a few minutes Check it out  →

Scan, understand, and fix accessibility issues without the complexity. Check it out  →

Last but not least, updates from WP-CONTENT.CO 👇

WordPress Credits Introduces Five Sponsorship Tiers for 2027

WordPress Credits is introducing five new sponsorship tiers for 2027 as the program looks to secure funding for…

Read more

Rank Math PRO Supply Chain Attack Distributed Malware Over an 11-Hour Window

Rank Math has disclosed a security incident in which attackers gained access to its systems and introduced malware…

Read more

PHP Patches Critical PHP2Shell Flaws as Hosting Providers Roll Out Fixes

PHP has released security updates to address two critical remote code execution vulnerabilities, dubbed “PHP2Shell”, that could allow…

Read more

UpdraftCentral Attack Uses Compromised Keys to Install Backdoors on WordPress Sites

TeamUpdraft (the company behind UpdraftPlus) has confirmed unauthorised access to teamupdraft.com over the weekend of 17–18 October 2026,…

Read more

Team WP-CONTENT.CO

Issue #294   |   October 27, 2026   |   Reading time: 21 mins

This weekly newsletter is kindly sponsored by ProfilePress, HireZoot and AccessMate

Built with Newsletter Glue.