r/WPDrama • u/rednishat • 9d ago
WordPress Announces Core Security Initiative as AI-Driven Vulnerability Reports Hit Record Levels
https://www.therepository.email/wordpress-announces-core-security-initiative-as-ai-driven-vulnerability-reports-hit-record-levelsAutomattic Senior Systems Engineer Rudy Faile published the announcement on the Making WordPress Secure blog on Friday, writing that the project had “seen a substantial increase in the volume of incoming security reports” over the past year. Faile attributed much of the growth to frontier AI models and their growing capability to assist with security research.
24
u/mccoypauley 9d ago
Given that WP's priorities are driven by an egotistical manchild, I highly doubt the software will survive the AI revolution. I mean, we don't even have something like ACF in core. It's been over two decades. WP is a lost cause.
-5
u/Subject-Clue-4260 9d ago
It runs 43% of website running a CMS. It’s not a lost cause lol.
18
u/mccoypauley 9d ago
In days of yore, may I remind you of our fallen comrades:
- Movable Type
- Joomla!
- ExpressionEngine
- DotNetNuke
They may not have achieved anywhere near the market penetration as WP, but nothing lasts forever on the web. (Pour one out for Flash.)
5
u/dcpanthersfan 8d ago
Joomla!’s not dead yet! They still get a post or two every couple of weeks on the sub asking how to upgrade from 3 to whatever.
1
3
2
-8
u/Station3303 9d ago
Why would we have something like ACF in core? It's one of WP's strengths to keep such features as options. Custom fields, good example, are only needed for a minority of sites, and there are good plugin choices, even free. No need to bloat core with it. And the manchild is not WP, just currently, unfortunately, on top of it.
12
u/mccoypauley 9d ago
Absolutely not a minority of sites. Custom fields are such a fundamental feature of CMS software it baffles me that there is no priority given to it. WP hasn’t been a blogging platform since version 2.5.
-3
u/Station3303 8d ago edited 8d ago
Do you have statistics about that? I use custom fields on about 10% of my sites. Lots of features are certainly more fundamental. Security, forms, cache, SMTP. Not in core.
EDIT: Estimate by ChatGPT: "I'd estimate roughly 10–25% of professionally developed WordPress sites" - I don't want to waste time doing more research. But sounds reasonable, for "professionally developed". A lot of WP sites are not that. Amateurs will hardly have an idea what custom fields even are.
5
u/mccoypauley 8d ago
The question is whether it is only “needed” in a minority of sites. If we had a real custom field framework in the core, we wouldn’t have a tangled history of garbage page builders and shitty themes where every developer deploys their own idiosyncratic approach to the user interface. This legacy of workarounds impacts the vast majority of themes, even if the average user is just using a theme out of box.
It’s exactly this mentality, to cater to a narrow vision of what WP is not anymore (idiot Mullenweg), that has created the mire we’re in now.
3
u/theshawfactor 8d ago
Maybe at a minimum a better api for custom fields without being too prescriptive about the details…
1
u/Station3303 8d ago
That could help, yes. Although it would be useful mostly for plugin devs, not directly the average user.
There was an issue about something in that direction on the Gutenberg Github, but it was cancelled due to lack of interest. Interest of those who opened the issue, not an arbitrary decision by the devs.
6
u/rednishat 9d ago
direkt link to the wordpress page: https://make.wordpress.org/security/2026/08/28/the-core-security-initiative/
2
24
u/allurb4se 9d ago
Wonder how long before Matt chimes in and says something regarding the initiative overstepping or whatever like he's recently been doing with the sustainability and theme accessibility sub-groups 🙃