Author name: John

WordPress.org blog: What Happened at WordCamp Europe 2026

WordCamp Europe, the biggest WordPress conference in Europe, spent the first week of June in Kraków. The 2026 edition of this event filled the ICE Kraków Congress Centre from June 4 to 6, drawing 2,458 ticket holders from 81 countries to the south of Poland. Close to a quarter of them were attending their first WordCamp Europe. The city made it easy to settle in. Every attendee’s badge carried a transport hologram good for unlimited trams and buses. The Main Market Square, the largest in Europe, sat a short ride away, and the local food ran the gamut from pierogi to żurek soup to obwarzanek pretzels sold off the street. Kraków is beautiful, with history everywhere.– Sebastian Miśniakiewicz, local team lead The program kept pace with the setting. Across multiple tracks, the schedule held 49 talks and eight hands-on workshops, grouped into themes that ran from core development and AI to business and the open web. Around them sat a full Contributor Day, a sponsor area, side events, on-site childcare, and an after-party the local team stretched to eight hours. Contributor Day Opens the Week As it does every year, the event began the day before the talks. Contributors filled the venue for Contributor Day, a working session where people work together to improve WordPress itself rather than watch a presentation about it. The morning started with registration and a welcome, the room split into teams, and a group photo broke up the work around midday. The afternoon ran a second working block before each team gathered to share what it had done. The range of tables is the clearest picture of how wide the project has become. Newcomers could sit down with Polyglots to translate WordPress into their own language, with Documentation to fix the pages people reach when they get stuck, or with Support to answer questions in the forums. More technical tables covered Core, Performance, Testing, Themes, and the Plugins team, whose reviewers screen every plugin submitted to the directory. First-timers were not left to find their own way. The day was built around onboarding tables, named table leads, and mentors, with an open invitation for experienced contributors to adopt a newcomer and walk them through their first patch, string, or ticket. People who could not travel to Kraków were welcomed to join remotely through the #contributor-day channel in the Make WordPress Slack, so distance was not a reason to sit the day out. The Birthplace of the Web It was fitting that the opening keynote came from CERN. The European Laboratory for Particle Physics, on the French-Swiss border outside Geneva, is where the World Wide Web was invented more than 30 years ago, and Joachim Valdemar Yde, who has managed CERN’s web team since 2021, came to explain why the laboratory had chosen WordPress to carry its web presence forward. Yde and Francisco Borges Aurindo Barros, who leads CERN’s WordPress infrastructure, framed the move as a chance to give a web presence built up over three decades a shared, modern foundation. After evaluating several leading content management systems against CERN’s needs, WordPress came out on top. Barros walked through what they had built. The guiding idea is that people at CERN focus on their content while the web team looks after the platform underneath. A self-service portal lets anyone request a site in a few clicks. Behind it, a shared distribution supplies a common theme and a set of approved, security-hardened plugins, and an in-house tool provisions each new site on Kubernetes in about a minute. In its first year, the platform has already set up hundreds of sites. Moving years of existing content onto the new platform is the other half of the work, and the team automated it: a single command lifts each site’s pages, headings, and images and rebuilds them as Gutenberg blocks, with no downtime. They plan to open source the tool. Then Yde delivered the line that the room had been waiting for. As of today, our main flagship website, home.cern, is now served on WordPress. It’s been automatically migrated, and it’s live. – Joachim Valdemar Yde, Web Manager, CERN The rollout is on track to wrap up over the coming months, and early impressions, Yde said, have been overwhelmingly positive, with easy wins in responsiveness and accessibility. For those at the event, the keynote pointed the room toward a later talk by CERN’s Akanksha Chatterjee on building and maintaining the laboratory’s engineering websites on the same service. There is a neat symmetry to it. The institution that published the world’s first website now runs on the software that powers more than 40% of today’s web, licensed under the GPL and maintained by the people in the room. WordPress 7.0 and AI WordPress 7.0 was a throughline of the conference. Several sessions placed the release at the center, framing it less as a routine update than as a change in what the software is, and in what it makes possible for the people who build with it. The anchor for that conversation was a panel called “Inside WordPress 7.0.” It gathered contributors who worked on the release, among them Juan Manuel Garrido, Adam Silverstein, Benjamin Zekavica, Sarah Norris, and Milana Cap. It was framed around more than a feature list, setting out to cover how a release of this size actually comes together: the contribution workflows, the coordination, and the human aspects of shipping software in the open. What gives this release its weight is the work moving into WordPress’s core: a native AI client, a new Abilities API that lets plugins declare what they can do in a way other tools can discover, and a Connectors screen for wiring up providers such as OpenAI, Anthropic, or Google Gemini. The argument running through the AI sessions was that this belongs to everyone who builds on WordPress, not only to developers shipping their own integrations. Speakers got specific about how to put that to work. Anukasha Singh focused on how the

WordPress.org blog: What Happened at WordCamp Europe 2026 Read More »

Uncategorized

Gutenberg Times: Calls for Testing, Gutenberg 23.3, Block MCP and more — Weekend Edition 367

Hi there, This is the time of the year when publishing on the Gutenberg Times becomes less frequent. I will be on vacation and back at the beginning of July with the weekend edition, just in-time for Beta 1 of WordPress 7.1. Three more Gutenberg plugin releases will happen before that. What also happened was that someone grabbed my instagram account in this AI hack at Meta. Although Meta reports this as resolved, I probably won’t get my account back. I am now actively looking for a better way to share my photos without the overlords that can’t keep things tight. It’s not that I didn’t know better. <sigh/> It’s a cautionary tale for what’s in store for all internet services handing over crucial business processes to a gulliable AI. Don’t let the small stuff bring you down. Have a splendid weekend ahead. Until July! Yours, Birgit I started watching WordCamp Europe LiveStreams on Friday and started with the keynote Two worlds collide: WordPress at CERN with Joachim Valdemar Yde and Francisco Borges Aurindo Barros. The Livestream are all routed to the WordPress YouTube account. The schedule is posted on the website. Over the course of the weekend more recordings will be uploaded to WordPress TV > WordCamp Europe 2026. On Saturday, Matt Mullenweg, co-founder of WordPress and CEO of Automattic will close out WordCamp Europe 2026 with his keynote. Afterward, the organizers will reveal where WordCamp Europe 2027 will take place. Tune in around 2:15 UTC / 8:15 am EDT. I had the great pleasure chatting with Abha Thakor on the OpenMakers through what WordPress 7.0 “Armstrong” means for you. First, the safety bit: test on a staging site or Playground before updating, and check your PHP. Then the good stuff. Visual revisions show edits in context with color coding. Notes keep feedback inside the editor. Patterns gain content-only editing, blocks can hide by device, and new AI connector APIs give developers a unified foundation. Real-time editing waits for a later release. Developing Gutenberg and WordPress Arthur Chu walks you through what’s new in Gutenberg 23.3. The modal media editor is now the default for cropping. It pulls cropping, flip, rotation, and metadata into one place. The experimental customizable dashboard grows too, with five new widgets you can drag and resize. Responsive styles now reach individual blocks, so designs adapt per screen. Rae Morey reports that Gutenberg 23.3 brings an experimental, customizable WordPress dashboard. It’s the admin’s biggest structural shakeup in years. You can drag, resize, and rearrange widgets like Welcome, Activity, and Site Health to fit how you actually work. It’s the first testable preview of a long-discussed overhaul. Enable it under Gutenberg > Experiments to try it. Jarda Snajdr reports that the React 19 upgrade has been reverted in Gutenberg. Shortly after 23.3.0 shipped, many plugins built for React 18 started crashing. The APIs barely changed, but the runtimes clashed: React 19 rejects elements made by a bundled React 18 JSX helper. So 23.3.2 rolls back to React 18. The team still plans the upgrade for 7.1—this time with a feature flag and a compatibility layer. Isabel Brison and I chatted extensively about the latest Gutenberg plugin releases 23.1 to 23.3 and discussed the responsive controls now available in the Gutenberg plugin for desktop, tablet and mobile view ports. The episode will drop in your favorite podcast app over the weekend. The latest episode is Gutenberg Changelog #130 – WordPress 7.0, Gutenberg 22.9 and 23.0, WordCamp Europe, Block Themes and More with Tammie Lister, Chief Product Officer at Convesio Rich Tabor shares a few “little big things” for WordPress editing. The idea is simple: complexity has piled up, and small fixes can clear it. His PRs make block locking a one-click job in List View. They keep you in place when editing synced patterns, instead of whisking you off to another view. And zooming out reuses the familiar Patterns Explorer. He’s not precious about them—contributors are warmly invited to take them over the line. Dave Smith walks you through an interactive prototype reimagining the WordPress Site Editor around user goals rather than system architecture. Built during Automattic’s Radical Speed Month, it keeps the same blocks, templates, and data model intact while changing entry points, language, and defaults. It’s an experiment, not a roadmap. Calls for Testing for WordPress 7.1 With WordPress 7.0 out the door, contributors shared a series of Calls for testing this week to prepare for WordPress 7.1. The schedule is tight with Beta 1 slated for July 15, 2026. Ramon Dodd puts out a call for testing the new Media Editor Modal. Cropping in the block editor hasn’t changed much in years, and the old inline tool leans on a limited third-party library. This new standard way of Image edition inside the Block editor replaces it with a WordPress-native one. You get freeform and aspect-ratio cropping, flip, rotation, and metadata editing in one place. The quickest way to try it is a ready-made Playground link. Feedback is welcome via the comments or GitHub. Anne McCarthy announced a collaborative editing outreach effort for WordPress 7.1. After real-time collaboration was pulled from 7.0, this gathers real-world early adopters across many hosting setups to find bugs faster. It lives in one Slack channel, #collaborative-editing-outreach. If you’d use collaborative editing regularly and run the latest Gutenberg, you’re invited—through the cycle, with a test team badge at the end. Rae Morey has the skinny for you in Contributors Launch FSE-Style Outreach Program to Get Real-Time Collaboration Ready for WordPress 7.1 Adam Silverstein puts out a call for testing client-side media processing, now targeting WordPress 7.1. Here’s the idea: when you upload an image, your browser resizes and encodes every size locally using VIPS in WebAssembly, before anything reaches the server. That eases CPU and memory load on hosts and brings modern formats like AVIF, WebP, HEIC, and JPEG XL to every site. Browsers that can’t cope fall back quietly to server-side. Try it in Chromium with the latest

Gutenberg Times: Calls for Testing, Gutenberg 23.3, Block MCP and more — Weekend Edition 367 Read More »

Uncategorized

Matt: WCEU

Cześć wszystkim, Kraków… I made the call not to fly to Poland for WordCamp Europe. I’m very sorry for the last-minute notice; I was really hoping to make it. I’m okay, but I want to stay close to loved ones going through difficult times. Seeing the pictures from Contributor Day warms my heart. Bardzo za Wami tęsknię. I miss you dearly. The Protect The Shire post on W.org contains what I planned to talk about, and Mary Hubbard and Matías Ventura will lead the Q&A keynote at the end. I’ll watch all the sessions so if any WordCamp speakers would like feedback on their talk, just fill out this form, and I’ll write something up and message it to you on the .org Slack. 

Matt: WCEU Read More »

Uncategorized

WordPress.org blog: Protect The Shire

tl;dr: Temporary 24-hour cooldown period for plugin/theme releases before auto-updates. AI can give defenders an edge. We want to secure all 78K plugins and themes on WordPress.org. One of the things we’ve always striven to do as the developers of WordPress is to work harder so you don’t have to; we take technology that’s complex or inaccessible and make it available to everyone, running in as many environments as possible. It’s the Open Source way. Just last December there was a step-change in coding ability that rocked many developers, and since April’s reveal of Mythos, security activity has kicked into high gear. A few days ago, Chrome shipped a release with 429 security fixes! The threats and opportunities of these new capabilities inspired us to kick off an initiative we call Protect The Shire (hat tip J. R. R. Tolkien) with the aim of using our best minds and the infrastructure of WordPress.org to make all code in our directories and repositories as secure as possible. Much of this work was and will remain behind the scenes, and we hope its success is defined mostly by what doesn’t happen. However, while we reckon with our newfound powers, we need to make space for review. To Update or Not WordPress core updates go through multiple people and layers of review before they go out, a process we’ve polished to a high art in the 18 years since we introduced one-click upgrades in 2.7 “Coltrane.” Core is solid, and I’m so proud that over 50% of all WordPress sites have upgraded to 7.0 within two weeks! That’s the result of an unimaginable amount of work across thousands of hosts, developers, and teams across WordPress.org. We’ve pushed hard to make upgrades happen automagically, and as fast as possible. We’re in a liminal period now, and I believe 2026 will be a year of tension between two approaches: updating as quickly as possible to stay secure, and holding back on updating to stay secure. We’ve seen clever and dangerous supply chain attacks across the npm, PyPI, GitHub, and RubyGems ecosystems, and we even had our own mini-version with the Essential Plugins debacle, where good plugins were unknowingly sold to a new author who had malicious intent. How to balance security updates and securing updates? Mirkwood or the Wild West? Everyone knows the fun of WordPress is in its 78k+ plugins and themes. We have a rigorous, human-powered review process for theme and plugin submissions, but once you’re published in the directory, you’re on your own. Our update system currently distributes every plugin and theme release as soon as a developer presses the button. That’s what keeps the directory as robust as WordPress itself. There were over 3,000 commits to the plugin repository yesterday! For now, each new plugin release will wait up to 24 hours before being distributed through auto-updates. This will give everyone, including a new Wapuu we call Gandalf, a chance to review changes. I expect 24 hours could be reduced to minutes as the process evolves, but we’ll err on the side of caution while AI models are advancing so rapidly. Our plugin review team seems superhuman, but still needs to sleep. But bots don’t, and a depth of review that seemed unimaginable before is now a matter of time and tokens. The security capabilities of AI are going to make the world weird and take a lot of our focus in the next few months, but there’s a light at the end of the tunnel. Our Shire Is Special There’s no shortage of ways to find, install, and update plugins and themes for WordPress. For those who choose WordPress.org, though, we want to make sure that it feels safe and secure. That means staying strict about some things—like guidelines and Open Source licenses—while also remaining flexible enough to allow solo hackers, community projects, and for-profit commercial plugins and themes to thrive in our ecosystem. GitHub stars may get the hype, but if you add up all the numbers in our plugin directory, it’s over 400M installs. There are 69 plugins, many from solo devs, installed on over a million sites each! Now we need to learn from the best parts of GitHub and make that available to every developer on WordPress.org. Just because WordPress plugins have a reputation for vulnerabilities is no reason not to aim for the same security and stability we’ve achieved in core. We’ve done the impossible a few times already in our journey from a b2/cafelog fork to where we are today. Freedom and security are not zero-sum. With Open Source, we can show how security comes from transparency, not obscurity. Collaboration over competition. What we accomplish when we come together is nothing short of incredible. Success always attracts bad actors, but we grow stronger through every adversity. The scale of WordPress can make some challenges seem too big to tackle, but given time, there is no problem that’s insurmountable. I’m reminded of the story behind the title of Anne Lamott’s book Bird by Bird: Thirty years ago my older brother, who was ten years old at the time, was trying to get a report written on birds that he’d had three months to write, which was due the next day. We were out at our family cabin in Bolinas, and he was at the kitchen table close to tears, surrounded by binder paper and pencils and unopened books about birds, immobilized by the hugeness of the task ahead. Then my father sat down beside him, put his arm around my brother’s shoulder, and said, “Bird by bird, buddy. Just take it bird by bird.” More to come, stay tuned. I wish everyone in Kraków at WordCamp Europe the best and hope to see you soon!

WordPress.org blog: Protect The Shire Read More »

Uncategorized

[NEW] How to Use Meta’s WhatsApp AI Agent in WordPress

Meta started rolling out its WhatsApp AI agent (officially called Meta Business Agent) to eligible businesses worldwide. Its AI agent can answer questions, recommend products, and qualify leads for your business around the clock. For small businesses, that means you don’t have to hire additional staff to qualify leads. Since it works 24/7, no need to worry about missed messages during non-work hours. The problem is that it only works inside WhatsApp, so the visitors sitting on your website right now never see it. What if I told you that you can put that same AI agent to work right on your WordPress site? That means you can turn your casual visitors into qualified leads before they ever click away! In this guide, I’ll show you how to set up Meta’s WhatsApp AI agent and connect it to your WordPress site, step by step. Quick Summary: First, turn on Meta’s Business AI inside the WhatsApp Business app. Then install WPChat on WordPress, connect your WhatsApp Business number, and set up an on-site Smart FAQ. Visitors get instant answers on your site and flow into WhatsApp, where Meta’s AI handles the rest. Setup takes about 30 minutes. What Is Meta’s WhatsApp AI Agent? Meta Business Agent is an AI assistant that lives inside WhatsApp Business and Instagram direct messages (DMs). More than a million businesses are already using it in countries like India and Brazil. Meta is now expanding it to more businesses worldwide. Once it’s set up, it can answer customer questions 24/7, suggest products from your catalog, book appointments, and collect lead details. It also hands the conversation to a real person whenever the customer asks or the question gets too complex. For now, small and medium businesses can use it for free through the WhatsApp Business app. Meta has said larger businesses will eventually pay based on usage through a Premium plan. Here’s the catch: Meta’s AI agent only works inside WhatsApp. It does not place a chatbox on your website, so a visitor browsing your homepage has no way to reach it unless you give them one. Why Connect Meta’s WhatsApp AI Agent to Your WordPress Site? For a small business, this isn’t just a cool integration… It’s about capturing sales you’re currently losing: Catch customers at the exact moment. Your visitors are on your website, not in their WhatsApp app, when they’re deciding whether to purchase from you. Having a conversation with them at the right moment removes the friction that makes people bounce Get your time back (without hiring anyone). As a small business owner, you can’t be glued to your phone answering the same questions all day and night. Meta Business Agent handles the repetitive stuff for you 24/7, so you don’t have to worry about after-hours messages. Start helping visitors today, even before Meta reaches you. Meta’s agent is still rolling out, so it may not be available for your account yet. With the WPChat plugin, your visitors get instant AI-powered answers right now, so you don’t have to wait to start converting. Now let’s set everything up. 👇 Step 1: Turn On Meta’s Business AI in WhatsApp Before you add anything to WordPress, it helps to switch on the AI agent that will answer your WhatsApp messages. You’ll need the WhatsApp Business app on your phone, which is different from the regular WhatsApp app. Open the WhatsApp Business app and tap the ‘Tools’ tab. Look for the option called ‘Your Business AI’ and tap it to start the guided setup. From there, WhatsApp walks you through training the agent. You’ll add your business details, connect a product catalog if you have one, and upload a short FAQ covering things like your hours, shipping, and return policy. You’ll also set your handoff rules, which decide when a chat should be passed to a real person. I recommend keeping these generous at first so that customers can always reach a human easily. There are also a few rules Meta requires you to follow: Your AI has to identify itself as an assistant. It can only handle business tasks (not open-ended chat). Customers must be able to request a human at any time. Note: Meta’s Business AI is rolling out in stages, so you may not see ‘Your Business AI’ in your Tools tab yet. Don’t worry! Until you get access, you can rely on WPChat‘s smart search, which helps your users find the relevant answer based on their intent. Plus, its smart FAQ system helps customers get instant solutions to common queries. Go ahead and complete the rest of this guide and have a working chat widget on your WordPress site. You can turn on the Meta handoff once it reaches your account. Once your agent is active, any message sent to your WhatsApp Business phone number can be answered automatically. Next, let’s give your website visitors a way to start that conversation. Step 2: Install and Activate WPChat WPChat is the plugin that connects your WordPress site to WhatsApp. It’s made by Smash Balloon, the team behind some of the most popular social media plugins for WordPress, so it’s built to be beginner-friendly. First, you’ll need to install and activate the WPChat plugin. If you need help with this step, see our guide on how to install a WordPress plugin. Note: The free version of WPChat is enough to add a WhatsApp chat widget and a basic FAQ to your site. You only need a paid plan for AI-powered Smart Search, chat funnels, extra agents, and advanced page targeting, which I’ll point out as we go. Step 3: Connect Your WhatsApp Business Number After activating the plugin, you’ll see a new WPChat menu in your WordPress sidebar. Click it, then click the ‘Set Up’ button to start the onboarding wizard. The first thing it asks for is your phone number. Enter the same WhatsApp Business number you used in Step 1, since this is where your visitors’ messages will land. Have your phone nearby in case you’re asked to verify the number by

[NEW] How to Use Meta’s WhatsApp AI Agent in WordPress Read More »

Uncategorized

Hundred Islands: A World of Endless Adventure

Hundred Islands: A World of Endless Adventure (1st Photo) “100 Islands Mountain View” by Kamoteus (A New Beginning) is licensed under CC BY 2.0. (2nd & 3rd Photo) “100 Islands” by Allan Reyes is licensed under CC BY-NC-ND 2.0. Hundred Islands National Park in Pangasinan is one of the most iconic natural attractions in the Philippines, known for its unique formation of over a hundred limestone islands scattered across the sea. Each island has its own character, offering a mix of adventure, relaxation, and natural beauty that attracts both local and international travelers. Island hopping is the highlight of any visit. Travelers can explore different islands in a single day, each offering something new—from hidden caves and rock formations to white sand beaches and panoramic viewpoints. The clear blue waters surrounding the islands make activities like swimming, snorkeling, and kayaking even more enjoyable. Beyond its scenic beauty, Hundred Islands also provides a sense of excitement and discovery. Some islands are developed with facilities for visitors, while others remain untouched, preserving their natural charm. This balance between accessibility and preservation makes the destination unique and versatile. The experience becomes even more memorable during sunrise or sunset, when the islands are bathed in golden light and the sea reflects soft colors of the sky. It creates a peaceful yet awe-inspiring atmosphere that stays with visitors long after they leave. Hundred Islands is more than just a tourist spot—it is an adventure playground shaped by nature. It invites travelers to explore, appreciate, and enjoy the beauty of the sea in its many forms. Date Published: December  16, 2026

Hundred Islands: A World of Endless Adventure Read More »

Uncategorized

WPTavern: #219 – Austin Ginder on How AI Is Exposing Hidden Threats in WordPress Plugin Updates

Transcript [00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, how AI is exposing hidden threats is WordPress plugin updates. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact forward slash jukebox and use the form there. So on the podcast today we have Austin Ginder. Austin has been involved in the WordPress ecosystem since 2010, and since 2014 has run Anchor Hosting, a business that manages thousands of WordPress websites. While he’s a developer and automation enthusiast at heart, in recent months Austin has found himself at the forefront of a burgeoning crisis in WordPress, security supply chain attacks targeting plugins. A chance discovery during a malware cleanup on a client’s site, propelled Austin into what would become a wider investigation of plugin vulnerabilities. What he uncovered is both alarming and timely. Bad actors aren’t just hacking sites directly, but are instead infiltrating the supply chain, either by purchasing plugin companies and weaponising them, or by hijacking plugins and pushing out malicious updates. These attacks are subtle, often shifting plugin update servers away from wordpress.org to rogue channels where malware can be distributed, leaving end users in the dark, and their sites at risk. We trace Austin’s journey from accidental security investigator to creator of the WP Beacon Project, a resource aimed at tracking, documenting, and alerting the WordPress community to known supply chain attacks. He shares how AI tools have radically changed what’s possible in threat detection and forensics, enabling individuals, and hopefully someday, the larger hosting providers to identify patterns and root causes behind widespread infections. We get into case studies of specific plugins compromised in recent months, the challenges of auditing over 60,000 plugins in the wordpress.org repo, and the complexities of stopping these attacks once malicious code is in the wild. Austin also discusses his hopes for greater collaboration with hosts and security researchers aiming for better automated monitoring and response. If you manage WordPress websites, create plugins, or just care about the future of open source security, this episode is for you. If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well. And so without further delay, I bring you Austin Ginder. I am joined on the podcast by Austin Ginder. Hello, Austin. [00:03:40] Austin Ginder: Hey, good to meet you. [00:03:41] Nathan Wrigley: Very nice to meet you too. I was put in Austin’s way by I think Courtney Robertson. Thank you Courtney for that because, on a different podcast, which I do, we were talking about an item, which is very much in the news at the moment. It’s all to do with plugins and security. And whenever I say security, any of the people that I have on the podcast, I feel it’s pretty important that person gets a chance to stamp their credentials into the podcast about themselves. Because it’s one of those areas where a little bit of knowledge can go a long way. Tell us about your background, WordPress hosting, security, those kind of things. [00:04:16] Austin Ginder: Sure. So I’m a developer, first off. I’ve been running a WordPress hosting service since 2014, and I’ve been working in the WordPress space since 2010. A long timer. I love automation. WPCLI commands, bash scripts. I’m in the weeds on a technical basis. But in terms of security, I wouldn’t call myself a security expert, which is ironic for this conversation because of some of the things I’ve been finding over the last month or so. And it’s all thanks to AI. AI has been my friend. It’s just right place, right time, getting lucky and also just a mix of everything is changing right now in the world. [00:04:56] Nathan Wrigley: Yeah. Thank you for that. So as you’re about to hear, we’re not gonna be talking at from the perspective of Austin demonstrates how to fix a particular challenge in WordPress. It’s much more of a general thing, and an alert really. It’s a bit of a call to action about a problem which has been systemic in the WordPress ecosystem, well, forever really, since I guess, plugins came along. And this is all about really change of ownership of plugins, and I could do a job of trying to describe the scenario here, but do you want to just run through what you’ve discovered in the last few weeks, and the three or four incidents that you’ve uncovered and what they mean and how they’ve come about? [00:05:37] Austin Ginder: Yeah. So in particular, we’re talking about supply chain attacks, and a supply chain attack is a different kind of attack. It’s not a direct, my site got infected with malware or something like that. It runs a little bit more deeper. It’s a scenario where either it can happen a couple different ways. A hacker might get control over the plugin repo itself, maybe a credential breach, where they sign in and they are acting as the author, and they push out bad code. As a user, you just update your plugin and you don’t realise you’re updating to something that’s harmful for your website. So that’s one scenario. The other scenario which is crazy to me, but like hackers literally buying companies and then weaponizing the plugins themselves and distributing them through the official channels. So that’s

WPTavern: #219 – Austin Ginder on How AI Is Exposing Hidden Threats in WordPress Plugin Updates Read More »

Uncategorized
Exit mobile version
%%footer%%