Brevo confirmed attackers stole a Cloudflare API key and injected malicious ClickFix scripts into its websites and customer sites for 5.5 hours on September 14, affecting approximately 100,000 websites. The hardcoded credential allowed attackers to create a Cloudflare Worker that modified content at the CDN edge, distributing malware including a WordPress backdoor plugin disguised as 'Web Media Optimizer.'
A long-time personal website owner reflects on how maintaining a self-hosted site has become increasingly difficult due to security vulnerabilities, AI-driven attacks, and bot scraping, despite initially advocating for personal websites as a technical endeavor worth the effort.
A PHP developer who wrote a 174-line temporary polyfill for http_build_url() in 2014 has deprecated it after discovering it accumulated nearly 20 million installs across Packagist, WordPress plugins, and Linux distributions. The package contained a bug where trailing slashes corrupted paths containing the letter 'a', and the author chose deprecation over maintenance to avoid security risks associated with widely-installed packages changing hands.
Studio Code is an AI agent tool for local WordPress development that allows users to click, type, or describe changes, with features for syncing, previewing, and deploying. It offers free desktop and CLI installations for streamlined WordPress site management.
WordPress.com now lets users build websites by describing their vision to an AI, which generates complete sites with layouts, images, and content that can be refined through chat or direct editing before publishing.
Automattic CEO Matt Mullenweg was placed on leave and temporarily replaced by CFO Mark Davies, but was reinstated after just 33 hours with no public explanation from the company. Industry observers speculate it may have been a failed boardroom coup, though the exact circumstances remain undisclosed, raising questions about governance clarity and employee confidence.
A researcher conducted empirical measurements of orphaned software across multiple ecosystems (Chrome extensions, PyPI packages, npm, WordPress plugins, GitHub projects) to test whether AI could economically exploit unmaintained code. Findings showed that most inactive projects lack active maintainers due to time constraints or life circumstances rather than high maintenance costs, and AI-assisted takeover offers are already being treated as spam. The scarce resource in maintenance is human authority to publish, not code work itself.
WordPress powers 40.3% of all websites globally, including major publications like the New York Post, TIME, and TechCrunch, as well as institutions like NASA, Harvard, and The White House. Its dominance stems from its flexibility, allowing use cases ranging from personal blogs to enterprise publishing platforms for governments, universities, and media companies.
Thousands of legitimate small-business websites have been compromised to distribute malware through fake CAPTCHA prompts that trick users into running Windows commands. Netskope identified over 5,400 compromised sites across 2,200 organizations, with attackers using blockchain infrastructure to hide malicious instructions and evade detection.
Automattic's board resigned after failing to oust CEO Matt Mullenweg via a paid leave vote. Mullenweg regained control within 33 hours, and board members Toni Schneider, Sue Decker, and Gen. Ann Dunwoody have departed. The board shakeup follows an ongoing trademark dispute between Automattic and WordPress hosting company WP Engine.
Code for the People is a documentary short by director Bao Nguyen exploring the past, present, and future of the open web, examining who controls the internet and how to preserve its freedom against corporate consolidation. The film argues that the open web—which powers over 40% of the internet through open source software like WordPress—is under siege by digital gatekeepers and closed AI systems. Releasing summer 2026 with premieres in San Francisco and New York, it calls for developers and builders to reclaim the open source spirit that built the internet.
WordPress founder Matt Mullenweg was ousted as CEO of Automattic by board vote but returned to his position within days after removing other admins from company Slack and asserting control. The company confirmed his reinstatement as chairman and CEO with full board support, though Mullenweg provided no official statement and instead posted cryptic messages about being a 'pirate' and buying a houseboat.
Matt Mullenweg was reinstated as Automattic CEO just two days after the board voted to place him on paid leave and appoint CFO Mark Davies as interim CEO. Mullenweg announced his return via Slack and social media, claiming the board was "back in agreement" and that he had removed key admins from the company's systems.
A store listing offers premium WordPress plugins, themes, and PHP scripts with activated licenses for $5 per item as of September 9, 2026.
Yac is a WordPress object cache extension that stores data in shared memory accessible to all PHP workers, eliminating the need for a separate cache server. It achieves ~19% faster page renders than Memcached by removing socket and network overhead, with no external infrastructure to operate or maintain.
Automattic founder Matt Mullenweg was reinstated as CEO after the company's board voted to place him on paid leave, in a move that quickly unraveled when Mullenweg resisted removal and regained control of company systems. The board subsequently confirmed his return with full support, though the exact reasons for the initial ouster remain unclear and board composition changes are reportedly ongoing.
AuraSurvey is an offline survey builder with drag-and-drop creator, 30 question types, conditional logic, and a Canvas-based dashboard that exports to PDF. It's a single <1MB vanilla JS library with zero dependencies, works across HTML, WordPress, React, Vue, and mobile WebViews, and includes integration templates for popular frameworks.
Matt Mullenweg has returned as CEO of Automattic, the major financial backer of WordPress. His reinstatement as leader is seen as positive for WordPress's future given his co-founder status and project involvement.
Automattic founder Matt Mullenweg was reinstated as CEO just two days after the board voted to place him on paid leave and appoint CFO Mark Davies as interim CEO. Mullenweg posted on Slack that the board is "back in agreement" and he is "in control," while Davies' account was deactivated. Mullenweg later posted on X characterizing the episode as a "coup attempt."
Matt Mullenweg announced via Slack that he has regained control of Automattic as CEO, days after the board voted to oust him and place him on paid leave with CFO Mark Davies as interim CEO. The situation remains unclear, with unconfirmed claims of board agreement and conflicting signals from Mullenweg's recent social media activity and unusual Slack posts.