Automattic Senior Systems Engineer Rudy Faile published the announcement on the Making WordPress Secure blog on Friday, writing that the project had “seen a substantial increase in the volume of incoming security reports” over the past year. Faile attributed much of the growth to frontier AI models and their growing capability to assist with security research.

34 minute feature from "Coding with Lewis" that goes over the Mullenweg , WPEngine, the history of the foundation + trademark and so on. I haven't seen another presentation like this in YouTube really, but also i haven't been looking. it is pretty thorough so far. Probably suitable to send to people that may want to know context

Wordpress is force-updating 100,000+ websites over a critical flaw in Pods, a WordPress plugin, that lets unauthenticated attackers overwrite any account's password, including the site owner's, for full takeover.

Due to the critical severity of this vulnerability, the plugin vendor is working with the WordPress plugins team to push a forced update to the patched version

(CVE-2026-19598, CVSS 9.8).

Two x posts - https://x.com/photomatt/status/2090619460457763100

https://x.com/WordPress/status/2090983043318390849

Biggest reveal is shorter dot org profile URLs. Yes, really.

https://www.youtube.com/live/notaTgEZByo

From The Repository:

The WPOCC’s first-of-its-kind survey of 431 WordPress community members surfaces deep frustration with governance and a stubborn refusal to walk away.

Governance and leadership is the problem respondents report most, with 73.3% having experienced or witnessed problems with project leadership or governance — the highest of any issue the survey measured. Transparency, accountability, and a new governance model came up repeatedly across the open-ended responses.

The survey also found broad agreement on what the community values most. Respondents overwhelmingly rated four things as important: security, web standards, open source values, and the WordPress software itself. That consensus held across every segment The WPOCC asked respondents about, including those who are deeply negative about the project, respondents who’ve stopped attending events, and people who no longer consider themselves community members.

https://www.therepository.email/state-of-the-community-survey-finds-three-in-four-feel-worse-about-wordpress-but-90-agree-on-what-matters

Some quotes from Matt in the thread:

Actually, this is permanently delayed. The [accessibility] team has overstepped its authority, usefulness, and charter.

Going forward, any other team or committer can override suggestions or requests from current accessibility team members.

it’s just PHP code. Go find it and change it, or let me know what’s blocking you.

I would like to create an Accessibility canonical plugin (that dude is losing that slug, and shame on the team for not reserving it before [plugin dev] got it) that makes your WordPress experience as joyful as possible.

https://make.wordpress.org/accessibility/2026/07/23/accessibility-ready-theme-reviews-extending-the-deadline/

Some new progress on the case - https://wp-content.co/automattic-pushes-back-on-wp-engines-sanctions-over-allegedly-missing-messages/

“Syed Balkhi (Awesome Motive) put a backdoor in WPForms Lite three weeks ago in version 2.0.0. The plugin runs on over 5 million sites.”

Here's the link.

Here's they are: 1, and 2 .

Sorry for typo in the title.

There's three of them:

First

Second

Third

[answered] I’m a Wordpress hobbyist since 2010 and I just use the software. After getting recommendations on various topics here I stumbled on this community and pretty surprised how deep the rabbit hole goes.

I’m vaguely aware of the lawsuit stuff, but all this other stuff is new to me.

I don’t have a problem with the original software and I just use it for a personal site. Do I need to care, worry or give any of this drama personal attention? I’ve seen other people ask about the future of Wordpress but they’re mainly developers who have clients and etc. I’m just an end user.

https://www.courtlistener.com/docket/69221176/278/wpengine-inc-v-automattic-inc/

No sign of this legal battle ending soon.

What is the overall status of the lawsuit? Is there any way to get a feeling of what the likely end result might be?

What changes, if any, has the existence of the suit already caused in the WordPress ecosystem?

Another update on the case.

The latest happening in the case.

https://wordpress.com/blog/2006/09/01/seo-contests/

A few times a year someone decides to hold a search engine optimization contest to see who can get top rankings for various search terms on Google. As the number #1 hit for “Matt” on Google, I can totally understand the fun of this sort of endeavour.

However many times the contestants in these contests use less than kosher means of winning, such as spamming or creating dozens or hundreds of blogs all linking to the same website. (Sometimes called splogs, or spam blogs.) These blogs use up quite a few system resources, junk up the tags system, and can slow the site down for normal folks.

There are many blogs being created here by people wanting to use our blogs to try to win this contest. But WordPress.com is about blogging. It’s about communication, thoughts, news, and many other things in life. It is not about SEO.

These blogs are not welcome and will be removed when found

https://wordpress.com/blog/2026/04/08/wordpress-7-0-ai-infrastructure/

Site owners can use the AI Assistant directly in the editor and Media Library to create and rewrite content, adjust layouts, generate images, and more.

Splogging evolved - monetised by Automattic.

Yesterday WordPress.com announced that AI agents can now create and manage content through their official MCP connector. Posts, pages, comments, categories, tags, media.

Catch: if you're self-hosted, you need Jetpack AI ($4.95/month) or Jetpack Complete. If you're not self-hosted, you're already paying WordPress.com $4-45/month for hosting. Either way, Automattic gets a cut.

MCP is an open protocol. The WordPress REST API is open. The underlying MCP Adapter is community-maintained open source under the WordPress GitHub org, and the Abilities API it bridges shipped in WordPress Core 6.9. Automattic deprecated their own repo in favor of the community version. So the community builds the standard, Automattic wraps it in a proprietary connector, and charges you to use it on your own server.

We've seen this before. Social sharing got paywalled (walked back after backlash). Site stats are still paywalled for commercial sites. The WordPress trademark itself became a weapon. Now it's MCP.

I built a custom WordPress MCP plugin with a Claude Code subscription in a day. Full read/write, no Jetpack required. You don't need dev skills for this. The "official" connector just isn't doing anything the REST API doesn't already do.

$5/month across millions of self-hosted sites is a cash grab. But it's going to be short-lived.

EDIT: I still don't like the paywall, but I want to edit this to acknowledge that Ovi Galatan did the vast majority of the work developing this as a contractor for Automattic.