DEV: Autumn-matically Updated 🍂

Welcome to DEV, your monthly WordPress deep dive.

Why did the skeleton skip the Halloween party? Because she had nobody to go with. 💀

Whatever spooky shenanigans you’ve been up to, we’re baaaaaack with another update.

Stick around to see a delightfully deceitful doggo.

In today’s edition:

• The PHP2Shell Shock that shook the internet, and what it means for you.
• I, Robot Admin: Core is preparing for the agentic web.
• Release the claws: a couple of nifty in-house OpenClaw projects we’ve been working on.

Hot Off The Presses: What’s New?

 
Total blog post views: 17

11 of those? Checking that all of the embedded images, media, headers and links are displaying correctly.

3 to see how it looks on mobile.

The rest? Nothing but bots and my mom.

(Hi, mom! 👋)

Well, anyway, if there’s anyone else out there reading this – it’s time to jump into the hottest scoop on what’s been happening in WordPress.

Ghost in the PHP2Shell 👻

If you haven’t heard (maybe you were on like, a digital detox or something) PHP got hacked. Quite badly.

The vulnerabilities are known as PHP2Shell, and they can give malicious actors access to a shell on a vulnerable server, where they could potentially access your database, API keys, and environment variables. Very spooky, indeed. 🫣

PHP has released the patch, which fixes several memory-safety vulnerabilities in the core engine.

What the heck!?
I know, right? After all… PHP only runs like, 70% of the web. 😅

Not only does it power WordPress, it’s also the programming language behind Drupal and MediaWiki, the software that runs Wikipedia.

This PHP scare is a big deal, and perhaps one of the most severe vulnerabilities we’ve seen in quite some time. Almost every version of PHP is affected by at least one of these issues, including releases that date back to PHP 5.4.

The flaws have been there for decades, but it took Frontier AI models to exploit them in ways that even the world’s most patient and skilled hackers hadn’t previously achieved.

The good news?
For any website that is hosted directly on WPMU DEV’s infrastructure, the server environment, including PHP updates and critical runtime patches, is handled automatically behind the scenes.

So, you don’t have to worry about manually patching PHP packages or touching server command lines. We’ve got your back!

If you haven’t already done so, you may want to proactively share a quick update with your maintenance clients letting them know their sites are protected against vulnerabilities like PHP2Shell that have been in the headlines.

Showing clients you’re monitoring server-level security builds trust and reinforces the value of your monthly care plans.

Important note:
If you manage hybrid environments, however, and you’re maintaining client sites across cPanel, Plesk, private VPS setups, or external hosts alongside your WPMU DEV hosting, the responsibility for server-level PHP patching will fall on you for those.

To check which version of PHP your sites run, go to Tools > Site Health > Info > Server in your WordPress admin. If you’re still on a version older than 8.2, it’s time to update!

Here’s a step-by-step 30 minute client check you can run just to double check everything’s cool.

P.S. If you’ve ever played Plague Inc., you’ll enjoy Oliver Sild’s playful “Vulnocalypse” live panic meter, showing you whether your level of concern should be at “second coffee,” “weekend cancelled” or “unplug the internet.”

Look at Me. I’m the Admin Now: 👀 MCP, WordPress and the Agentic Web

If you’re managing a fleet of client sites, you might already use AI to speed up development, handle image generation, or streamline SEO audits.

But let’s be real: right now, every AI tool in your stack probably lives on its own isolated island, held together by custom API keys, third-party glue code, and frantic browser window hopping.

WordPress Core is preparing to blow up those silos with a major architectural leap: making Model Context Protocol (MCP) a native part of the WordPress experience (with eyes are set on WordPress 7.3, but no release commitment… yet.)

Instead of juggling isolated prompts and plugin hacks, MCP gives autonomous AI agents a secure, standardized, native bridge to interact with site data and execute multi-step admin workflows right out of the box.

What is MCP (and why should you care)?
Think of MCP as an open, standardized bridge that lets external AI agents “talk” directly to a WordPress site’s backend data and structure in a safe, structured way.

Instead of just generating text, an AI agent could securely read site context, analyze diagnostics, or perform site tasks autonomously. The agent becomes more like a tool that sits right next to your sites, rather than something separate from them.

Some (such as Miriam Schwab), argue that WordPress has been building toward this since day one.

Key Takeaways for Web Creators:

• From widgets to autonomous agents: The WP AI Team’s four-part roadmap focuses on making WordPress “agent-ready.” Imagine AI tools that can audit site health, structure complex schemas, or handle multi-step administrative workflows across your portfolio.
• Security & authentication front and center: The core discussion isn’t just about what agents can do, but how to stop them from going rogue. Early benchmarking is heavily focused on strict authentication, capability checks, and permission scoping so AI agents only touch what you explicitly allow.
• Don’t lock down your API keys just yet: There’s no firm release date or final spec, and the Core AI team is making authentication, capability checks, and strict permission scoping the top priority before anything hits production.

Want a peek at what an MCP-driven WordPress could look like in the wild? Developers John Fraskos and Krishna Kant Chourasiya have already built Delta, a WordPress theme that an agent operates through MCP, while keeping the Block Editor available for content.

👉 The Bottom Line: The web is shifting from human-driven search to agent-driven workflows. Getting your client sites structured, clean, and secure now will ensure they’re ready when agentic WordPress officially lands.

🎶 With Claws Wide Oooooopen 🎶

Remember a couple of months back when we un-caged OpenClaw hosting for all our Premium members? In case you missed the memo, you can host as many OpenClaw agents as your heart desires right inside your Unlimited Hosting server, at zero extra cost.

We even made setup a painless, one-click install: drop in your API key, SSO right in, and boom: your AI minions are officially deployed.

If you’ve been experimenting with this in the lab, we want to hear what you’re building! To get your creative gears turning, check out two of our favorite in-house experiments:

🧠 OpenClaw Site Brain: Giving your WordPress site a collective memory so your agent actually understands your site structure and context.

🐤 OpenClaw Mail Canary: The ultimate automated sentinel that serves as a canary in a coal mine for your transactional email deliverability.

Built something cool with OpenClaw on WPMU DEV Hosting? Hit reply or drop a link in the comments, we’d love to check it out and feature your project in an upcoming issue! 🦀

Mind Bloggling Facts & Stats

WordPress 7.1.4 has been released, with patches for 22 vulnerabilities. Meanwhile 7.2 Beta 1 is ready for testing for those who like to live on the edge.

6.9 hours per night. Nope, that’s not how many hours I spend crying about plugin conflicts. Apparently, that’s how many hours of sleep the average dev gets, according to the data.

The WordPress Contributor Toolkit 2.0 says it comes with translations in 10 languages. But… two of those languages are English (Canada) and English (UK). Ummm… seems kinda squirrely, eh bud? 🍁 (Translation: That’s a bit dodgy, innit? ☕)

Blogs & Resources You Shouldn’t Miss

My hat’s off to Bob Dunn and Derek Hanson for this chat about fun blog post formats and categories. 🧢

Are you a woman in WordPress? 🙋🏻‍♀️ WP Wonder Women wants to feature you!

Lars Faye weighs in: Knowing how to use AI is not a real skill… you still need dev expertise, folks!

Next time you go to a WordCamp, skip the registration queue and just flash your QR code, like a boss. 😎

These digital tomes of historic lore (sort of the WordPress Silmarillion, if you will) can now be edited directly from GitHub.

Dan Knauss made Maintenance Art, to encourage giving a hand (and some cash!) to the folks who make open source happen.

Amy Hoy argues that the reverse-chronology style of blogs “broke the web” and killed the quirky, hand-curated personal site.

Coffee Break Distractions

“I’m one of the largest forums on the internet and I’m planning to go “logged-in only.” Ask Me Anything!”

This is really fun: Larp as AI and answer a prompt, or get an answer written by a random fellow human.

Man, if I could worm half this well, I’d be busting it out at every shindig. (And perhaps busting my face on the floor too…)

Is four a lot? Well, it depends. Dollars? Then no. For an encryption key? Also no.

Sometimes when I want to feel very, very old I think about the era of webrings. Were you ever in one?

Sure, it’s terrifying what AI knows about you. But I’m worried about my vacuum cleaner. That thing’s been collecting dirt on me for years.

The real nightmare before Christmas: “It’s a Wonderful Night of the Living Dead”

And finally…

Are you even a dog owner if your pup hasn’t tried to pull this one on you?

Love this mix of nerdery and nonsense? Share it with your favorite WordPress weirdo. 💗