{"id":224797,"date":"2026-11-03T14:36:14","date_gmt":"2026-11-03T14:36:14","guid":{"rendered":"https:\/\/wpmudev.com\/blog\/?p=224797"},"modified":"2026-11-02T14:31:31","modified_gmt":"2026-11-02T14:31:31","slug":"dev-autumn-matically-updated","status":"publish","type":"post","link":"https:\/\/wpmudev.com\/blog\/dev-autumn-matically-updated\/","title":{"rendered":"DEV: Autumn-matically Updated \ud83c\udf42"},"content":{"rendered":"<p><strong>Welcome to DEV, your monthly WordPress deep dive. <\/strong><\/p>\n<p>Why did the skeleton skip the Halloween party? Because she had <em>nobody<\/em> to go with. \ud83d\udc80 <\/p>\n<p>Whatever spooky shenanigans you\u2019ve been up to, we\u2019re baaaaaack with another update. <\/p>\n<p>Stick around to see a delightfully deceitful doggo. <\/p>\n<p><strong>In today\u2019s edition: <\/strong><\/p>\n<ul>\n<li><strong>The PHP2Shell Shock that shook the internet, and what it means for you.<\/strong><\/li>\n<li><strong>I, Robot Admin: Core is preparing for the agentic web.<\/strong><\/li>\n<li><strong>Release the claws: a couple of nifty in-house OpenClaw projects we\u2019ve been working on.<\/strong><\/li>\n<\/ul>\n<h2>Hot Off The Presses: What\u2019s New?<\/h2>\n<div class=\"image-grid cgrid-row\">\n<div class=\"cgrid-col cgrid-col-span-full\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2026\/11\/traffic.png\" alt=\"Humorous meme depicting thoughts about blog traffic origins\" width=\"600\" height=\"450\" class=\"aligncenter size-full wp-image-224798\" \/><\/div>\n<\/div>\n<p>&nbsp;<br \/>\nTotal blog post views: 17<\/p>\n<p>11 of those? Checking that all of the embedded images, media, headers and links are displaying correctly. <\/p>\n<p>3 to see how it looks on mobile. <\/p>\n<p>The rest? Nothing but bots and my mom. <\/p>\n<p>(Hi, mom! \ud83d\udc4b)<\/p>\n<p>Well, anyway, if there\u2019s anyone else out there reading this &#8211; it\u2019s time to jump into the hottest scoop on what\u2019s been happening in WordPress. <\/p>\n<h2>Ghost in the PHP2Shell \ud83d\udc7b<\/h2>\n<p>If you haven\u2019t heard (maybe you were on like, a digital detox or something) PHP got hacked. Quite badly. <\/p>\n<p>The vulnerabilities are known as <a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" rel=\"noopener\" target=\"_blank\">PHP2Shell<\/a>, and they can give malicious actors access to a shell on a vulnerable server, where they could potentially access your database, API keys, and environment variables. Very spooky, indeed. \ud83e\udee3<\/p>\n<p><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" rel=\"noopener\" target=\"_blank\">PHP has released the patch<\/a>, which fixes several memory-safety vulnerabilities in the core engine. <\/p>\n<p><strong>What the heck!?<\/strong><br \/>\nI know, right? After all\u2026 PHP only runs like, 70% of the web. \ud83d\ude05<\/p>\n<p>Not only does it power WordPress, it\u2019s also the programming language behind Drupal and MediaWiki, the software that runs Wikipedia. <\/p>\n<p>This PHP scare is a big deal, and perhaps one of the most severe vulnerabilities we\u2019ve seen in quite some time. Almost <em>every<\/em> version of PHP is affected by at least one of these issues, including releases that date back to PHP 5.4. <\/p>\n<p>The flaws have been there for decades, but it took Frontier AI models to exploit them in ways that even the world\u2019s most patient and skilled hackers hadn\u2019t previously achieved. <\/p>\n<p><strong>The good news? <\/strong><br \/>\nFor any website that is hosted directly on WPMU DEV\u2019s infrastructure, the server environment, including PHP updates and critical runtime patches, is handled automatically behind the scenes. <\/p>\n<p>So, you don\u2019t have to worry about manually patching PHP packages or touching server command lines. We\u2019ve got your back!<\/p>\n<p>If you haven\u2019t already done so, you may want to proactively share a quick update with your maintenance clients letting them know their sites are protected against vulnerabilities like PHP2Shell that have been in the headlines. <\/p>\n<p>Showing clients you&#8217;re monitoring server-level security builds trust and reinforces the value of your monthly care plans. <\/p>\n<p><strong>Important note:<\/strong><br \/>\nIf you manage hybrid environments, however, and you\u2019re maintaining client sites across cPanel, Plesk, private VPS setups, or external hosts alongside your WPMU DEV hosting, the responsibility for server-level PHP patching will fall on you for those. <\/p>\n<p>To check which version of PHP your sites run, go to <strong>Tools > Site Health > Info > Server<\/strong> in your WordPress admin. If you\u2019re still on a version older than 8.2, it\u2019s time to update!<\/p>\n<p>Here\u2019s a <a href=\"https:\/\/dev.to\/prospectsignal\/php2shell-is-patched-heres-the-30-minute-client-check-freelance-web-designers-should-run-today-568l\" rel=\"noopener\" target=\"_blank\">step-by-step 30 minute client check<\/a> you can run just to double check everything\u2019s cool. <\/p>\n<p>P.S. If you\u2019ve ever played Plague Inc., you\u2019ll enjoy Oliver Sild\u2019s playful \u201c<a href=\"https:\/\/vulnocalypse.com\/\" rel=\"noopener\" target=\"_blank\">Vulnocalypse<\/a>\u201d live panic meter, showing you whether your level of concern should be at \u201csecond coffee,\u201d \u201cweekend cancelled\u201d or \u201cunplug the internet.\u201d<\/p>\n<h2>Look at Me. I\u2019m the Admin Now: \ud83d\udc40 MCP, WordPress and the Agentic Web<\/h2>\n<p>If you\u2019re managing a fleet of client sites, you might already use AI to speed up development, handle image generation, or streamline SEO audits. <\/p>\n<p>But let\u2019s be real: right now, every AI tool in your stack probably lives on its own isolated island, held together by custom API keys, third-party glue code, and frantic browser window hopping.<\/p>\n<p>WordPress Core is preparing to blow up those silos with a major architectural leap: making Model Context Protocol (MCP) a <a href=\"https:\/\/make.wordpress.org\/ai\/2026\/10\/22\/ai-contributor-weekly-summary-21-october-2026\/\" rel=\"noopener\" target=\"_blank\">native part of the WordPress experience<\/a> (with eyes are set on WordPress 7.3, but no release commitment\u2026 yet.)<\/p>\n<p>Instead of juggling isolated prompts and plugin hacks, MCP gives autonomous AI agents a secure, standardized, native bridge to interact with site data and execute multi-step admin workflows right out of the box.<\/p>\n<p><strong>What is MCP (and why should you care)?<\/strong><br \/>\nThink of MCP as an open, standardized bridge that lets external AI agents &#8220;talk&#8221; directly to a WordPress site&#8217;s backend data and structure in a safe, structured way. <\/p>\n<p>Instead of just generating text, an AI agent could securely read site context, analyze diagnostics, or perform site tasks autonomously. The agent becomes more like a tool that sits right next to your sites, rather than something separate from them. <\/p>\n<p>Some (such as <a href=\"https:\/\/elementor.com\/blog\/wordpress-born-ready\/\" rel=\"noopener\" target=\"_blank\">Miriam Schwab<\/a>), argue that WordPress has been building toward this since day one.<\/p>\n<p><strong>Key Takeaways for Web Creators:<\/strong><\/p>\n<ul>\n<li><strong>From widgets to autonomous agents:<\/strong> The WP AI Team&#8217;s <a href=\"https:\/\/make.wordpress.org\/ai\/2026\/10\/28\/wordpress-for-the-agentic-web\/\" rel=\"noopener\" target=\"_blank\">four-part roadmap<\/a> focuses on making WordPress &#8220;agent-ready.&#8221; Imagine AI tools that can audit site health, structure complex schemas, or handle multi-step administrative workflows across your portfolio.<\/li>\n<li><strong>Security &amp; authentication front and center:<\/strong> The core discussion isn&#8217;t just about what agents <em>can<\/em> do, but how to stop them from going rogue. Early benchmarking is heavily focused on strict authentication, capability checks, and permission scoping so AI agents only touch what you explicitly allow.<\/li>\n<li><strong>Don&#8217;t lock down your API keys just yet:<\/strong> There\u2019s no firm release date or final spec, and the Core AI team is making authentication, capability checks, and strict permission scoping the top priority before anything hits production.<\/li>\n<\/ul>\n<p>Want a peek at what an MCP-driven WordPress could look like in the wild? Developers John Fraskos and Krishna Kant Chourasiya have already built <a href=\"https:\/\/deltatheme.com\/\" rel=\"noopener\" target=\"_blank\">Delta<\/a>, a WordPress theme that an agent operates through MCP, while keeping the Block Editor available for content. <\/p>\n<p>\ud83d\udc49 <strong>The Bottom Line:<\/strong> The web is shifting from human-driven search to agent-driven workflows. Getting your client sites structured, clean, and secure now will ensure they&#8217;re ready when agentic WordPress officially lands.<\/p>\n<h2>\ud83c\udfb6 With Claws Wide Oooooopen \ud83c\udfb6<\/h2>\n<p>Remember a couple of months back when we un-caged OpenClaw hosting for all our Premium members? In case you missed the memo, you can host as many OpenClaw agents as your heart desires right inside your Unlimited Hosting server, at zero extra cost.<\/p>\n<p>We even made setup a painless, one-click install: drop in your API key, SSO right in, and boom: your AI minions are officially deployed.<\/p>\n<p>If you\u2019ve been experimenting with this in the lab, we want to hear what you\u2019re building! To get your creative gears turning, check out two of our favorite in-house experiments:<\/p>\n<p>\ud83e\udde0 <a href=\"https:\/\/wpmudev.com\/blog\/openclaw-site-brain\/\" target=\"_blank\" rel=\"noopener\">OpenClaw Site Brain<\/a>: Giving your WordPress site a collective memory so your agent actually understands your site structure and context.<\/p>\n<p>\ud83d\udc24 <a href=\"https:\/\/wpmudev.com\/blog\/openclaw-mail-canary\/\" target=\"_blank\" rel=\"noopener\">OpenClaw Mail Canary<\/a>: The ultimate automated sentinel that serves as a canary in a coal mine for your transactional email deliverability.<\/p>\n<p>Built something cool with OpenClaw on WPMU DEV Hosting? Hit reply or drop a link in the comments, we\u2019d love to check it out and feature your project in an upcoming issue! \ud83e\udd80 <\/p>\n<h2>Mind Bloggling Facts &#038; Stats<\/h2>\n<p>WordPress <a href=\"https:\/\/wordpress.org\/news\/2026\/10\/wordpress-7-1-4\/\" rel=\"noopener\" target=\"_blank\">7.1.4 has been released<\/a>, with patches for 22 vulnerabilities. Meanwhile 7.2 Beta 1 is <a href=\"https:\/\/wordpress.org\/news\/2026\/10\/wordpress-7-2-beta-1-is-ready-for-download-and-testing\/\" rel=\"noopener\" target=\"_blank\">ready for testing<\/a> for those who like to live on the edge.  <\/p>\n<p>6.9 hours per night. Nope, that\u2019s not how many hours I spend crying about plugin conflicts. Apparently, that\u2019s how many hours of sleep the average dev gets, <a href=\"https:\/\/2026.stateofdevs.com\/en-US\/health\/#health_issues\" rel=\"noopener\" target=\"_blank\">according to the data<\/a>. <\/p>\n<p>The WordPress Contributor Toolkit 2.0 says it comes with <a href=\"https:\/\/make.wordpress.org\/core\/2026\/10\/23\/wordpress-contributor-toolkit-2-0-a-redesigned-app-in-your-language\/\" rel=\"noopener\" target=\"_blank\">translations in 10 languages<\/a>. But\u2026 two of those languages are English (Canada) and English (UK). Ummm\u2026 seems kinda squirrely, eh bud? \ud83c\udf41 (Translation: That\u2019s a bit dodgy, innit? \u2615)<\/p>\n<h2>Blogs &#038; Resources You Shouldn\u2019t Miss<\/h2>\n<p>My hat\u2019s off to Bob Dunn and Derek Hanson for this <a href=\"https:\/\/openchannels.fm\/post-formats-bring-back-the-fun-and-flexibility-in-blogging\/\" rel=\"noopener\" target=\"_blank\">chat about fun blog post formats and categories<\/a>. \ud83e\udde2<\/p>\n<p>Are you a woman in WordPress? \ud83d\ude4b\ud83c\udffb\u200d\u2640\ufe0f WP Wonder Women <a href=\"https:\/\/wpwonderwomen.com\/highlight\/\" rel=\"noopener\" target=\"_blank\">wants to feature you<\/a>! <\/p>\n<p>Lars Faye weighs in: Knowing how to use AI is not a real skill\u2026 <a href=\"https:\/\/www.youtube.com\/watch?v=5KYCm0-OGL4\" rel=\"noopener\" target=\"_blank\">you still need dev expertise, folks<\/a>! <\/p>\n<p>Next time you go to a WordCamp, skip the registration queue and just <a href=\"https:\/\/make.wordpress.org\/community\/2026\/10\/29\/new-for-organizers-qr-code-check-in-and-qr-codes-on-badges\/\" rel=\"noopener\" target=\"_blank\">flash your QR code, like a boss<\/a>. \ud83d\ude0e<\/p>\n<p>These <a href=\"https:\/\/make.wordpress.org\/meta\/2026\/10\/19\/the-wordpress-books-now-update-from-github\/\" rel=\"noopener\" target=\"_blank\">digital tomes of historic lore<\/a> (sort of the WordPress Silmarillion, if you will) can now be edited directly from GitHub. <\/p>\n<p>Dan Knauss made <a href=\"https:\/\/maintenance.art\/\" rel=\"noopener\" target=\"_blank\"><em>Maintenance Art<\/em><\/a>, to encourage giving a hand (and some cash!) to the folks who make open source happen.<\/p>\n<p>Amy Hoy argues that the reverse-chronology style of blogs \u201c<a href=\"https:\/\/stackingthebricks.com\/how-blogs-broke-the-web\/\" rel=\"noopener\" target=\"_blank\">broke the web<\/a>\u201d and killed the quirky, hand-curated personal site. <\/p>\n<h2>Coffee Break Distractions<\/h2>\n<p>\u201cI\u2019m one of the largest forums on the internet and I\u2019m <a href=\"https:\/\/techcrunch.com\/2026\/10\/29\/as-search-traffic-dries-up-reddit-announces-its-shifting-to-a-logged-in-experience\/\" rel=\"noopener\" target=\"_blank\">planning to go \u201clogged-in only<\/a>.\u201d Ask Me Anything!\u201d<\/p>\n<p>This is really fun: <a href=\"https:\/\/youraislopbores.me\/\" rel=\"noopener\" target=\"_blank\">Larp as AI<\/a> and answer a prompt, or get an answer written by a random fellow human.<\/p>\n<p>Man, if I could <a href=\"https:\/\/www.reddit.com\/r\/JustGuysBeingDudes\/comments\/1xg72vw\/perfect_worm\/\" rel=\"noopener\" target=\"_blank\">worm half this well<\/a>, I\u2019d be busting it out at every shindig. (And perhaps busting my face on the floor too\u2026) <\/p>\n<p>Is four a lot? Well, it depends. Dollars? Then no. For an <a href=\"https:\/\/arstechnica.com\/security\/2026\/10\/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle\/\" rel=\"noopener\" target=\"_blank\">encryption key<\/a>? Also no. <\/p>\n<p>Sometimes when I want to feel very, very old I think about the <a href=\"https:\/\/www.brisray.com\/web\/webring-history.htm\" rel=\"noopener\" target=\"_blank\">era of webrings<\/a>. Were you ever in one?  <\/p>\n<p>Sure, it\u2019s terrifying <a href=\"https:\/\/felloai.com\/what-does-ai-know-about-you-much-more-than-you-think\/\" rel=\"noopener\" target=\"_blank\">what AI knows about you<\/a>. But I\u2019m worried about my vacuum cleaner. That thing\u2019s been collecting dirt on me for <em>years<\/em>.  <\/p>\n<p>The <em>real<\/em> nightmare before Christmas: \u201c<a href=\"https:\/\/www.youtube.com\/watch?v=AGsB9eJUrSc\" rel=\"noopener\" target=\"_blank\">It\u2019s a Wonderful Night of the Living Dead<\/a>\u201d<\/p>\n<p><strong>And finally\u2026 <\/strong><\/p>\n<p>Are you even a dog owner if your pup <a href=\"https:\/\/www.reddit.com\/r\/ContagiousLaughter\/comments\/1x8ssq3\/smart_dog\/\" rel=\"noopener\" target=\"_blank\">hasn\u2019t tried to pull this one on you<\/a>?<\/p>\n<p>Love this mix of nerdery and nonsense? Share it with your favorite WordPress weirdo. \ud83d\udc97<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to DEV, your monthly WordPress deep dive. Why did the skeleton skip the Halloween party? Because she had nobody to go with. \ud83d\udc80 Whatever spooky shenanigans you\u2019ve been up to, we\u2019re baaaaaack with another update. Stick around to see a delightfully deceitful doggo. In today\u2019s edition: The PHP2Shell Shock that shook the internet, and [&hellip;]<\/p>\n","protected":false},"author":1204260,"featured_media":223199,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"blog_reading_time":"","wds_primary_category":0,"wds_primary_tutorials_categories":0,"footnotes":""},"categories":[11265],"tags":[],"tutorials_categories":[],"class_list":["post-224797","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dev"],"_links":{"self":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/224797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/users\/1204260"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/comments?post=224797"}],"version-history":[{"count":6,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/224797\/revisions"}],"predecessor-version":[{"id":224804,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/224797\/revisions\/224804"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media\/223199"}],"wp:attachment":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media?parent=224797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/categories?post=224797"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tags?post=224797"},{"taxonomy":"tutorials_categories","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tutorials_categories?post=224797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}