What changed in the lean web stack

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws rated CVSS v4 9.2, after advance notice on 20 October. PHP says there is no complete mitigation besides updating. PHP 8.1 and older get no upstream fixes, though source backports exist for 7.4 to 8.1. WordPress.org published an advisory the same day urging site owners to update PHP or check with their host.

Why it matters: Every WordPress or other PHP client site on unpatched or end-of-life PHP is exposed; check the PHP version on every host you manage.

US District Judge Araceli Martínez-Olguín allowed WP Engine's four antitrust claims (monopolisation, attempted monopolisation and two tying claims) and its WooCommerce-related claims to proceed. She dismissed its computer-extortion claim. All seven of Automattic's counterclaims survived at least in part. Other reports date the order to 24 September and say a jury trial is set for October 2027; neither was confirmed against the court docket.

Why it matters: The dispute over who controls WordPress infrastructure and trademarks will continue into 2027, which keeps governance risk around WordPress hosting.

Citing TechCrunch, Gizmodo reports that former CEO Toni Schneider, two more board members, the CFO and the chief legal officer left Automattic after the episode. Mullenweg brought in new board members (including author Hugh Howey), counsel and advisers. Automattic did not respond to Gizmodo's request for comment.

Why it matters: Power at Automattic is now more concentrated with Mullenweg, which matters for anyone betting on WordPress.com, WooCommerce or Jetpack.

Following a 404 Media report, Automattic confirmed on 10 September that Matt Mullenweg was on paid leave and that CFO Mark Davies was interim CEO. On 12 September the company said Mullenweg was back as chairman and CEO with full board support, and later said he had been away for only 33 hours and 20 minutes. No reason for the leave was given.

Why it matters: Leadership instability at the company behind WordPress.com and WooCommerce adds to the uncertainty around the WordPress ecosystem.

WordPress 7.1 brings per-breakpoint styles without custom CSS, a unified media editor, in-browser image processing with AVIF and HEIC support, Tabs and Playlist blocks, interactive button states, and an iframed post editor for all themes. Security releases 7.1.1 to 7.1.4 followed between September and 28 October.

Why it matters: Core WordPress is catching up on responsive design controls that visual builders such as Webstudio already offer.

Kirki (CVE-2026-8206, CVSS 9.8, more than 500,000 installs) has an unauthenticated account-takeover flaw in its password reset flow, fixed in 6.0.7. Burst Statistics (more than 200,000 installs; other sources give CVE-2026-8181) has an authentication bypass that lets attackers create admin accounts, fixed in 3.4.2. Wordfence reported blocking thousands of attacks in 24 hours. These are two examples from a steady run of exploited WordPress plugin flaws in 2026.

Why it matters: Plugin sprawl is the main WordPress risk for client sites and a strong argument for lower-maintenance static or managed stacks.

WordPress 7.0 was released on 20 May 2026 after slipping from its planned 9 April date. It adds a core AI Client that works with the Abilities API, a refreshed dashboard with a Command Palette, visual revision scrubbing, new blocks such as Breadcrumbs and Icons, and block-level custom CSS.

Why it matters: AI features are now part of core WordPress, which changes the comparison between WordPress and modern builders for client projects.