41 stories
An attacker reached the vendor's update server and two builds went out with a web shell in them. The files, the directory and the database rows to look for, why the version number cannot clear you, and what to do if you find one.
The patched release for every WordPress branch back to 4.7, what the reported Click2Shell chain actually needs before it works, why the 9.6 in the headlines is not WordPress's own rating, and the one trace a forced theme install leaves behind.
Thirty-five critical records in twenty-one days. The plugins with real install numbers behind them, the version that fixes each one, the core release nobody should miss, and the one that no version can fix.
Jev is a new kind of AI model from TypeSafe that answers typed questions with probabilities instead of writing text. What I found testing it, the one prompting lesson worth knowing, and how Respira AER 0.3 uses it to check every change to a WordPress site.
Respira AER is live: Respira builder intelligence in a chat connected to all your WordPress sites, in your dashboard and on your phone, with duplicates, approvals and receipts.
Your Claude or ChatGPT subscription is not an API account, which is why most WordPress AI plugins cannot use it. Here is the way round that, in plain terms.
An agency owner had trustees reviewing a staging site and no good way to collect what they said. Two days later the plugin mints a signed link that opens the page with a review bar, every note lands anchored to its element, and the agent applies the notes on a duplicate.
WebMCP put the agent on the same page as you: open a WordPress site in ChatGPT's browser and it stages edits, waits for approval, and rolls back. Every staged draft now returns a login-free preview link you can send to anyone.
Anthropic measured it: humans clicking approval prompts caught 13.6% of dangerous commands, falling to 5% after fifty prompts. Auto mode, Guardian and always-on cloud agents are the industry removing a button that was not working. What safety means for a WordPress site once nobody is watching.
WordPress.com gave sites a persistent AI memory, core is building wp_knowledge, and self-hosted sites have had Resonance since 3 August. What the three share, why memory that travels with the site beats memory that belongs to one assistant, and the one thing a memory cannot do by being read.
How to connect a live WordPress site to Hermes Agent and work on it from the terminal or the desktop app: what goes in ~/.hermes/config.yaml, browser sign-in per site or one server for the whole account, and what the agent can read and change once it is connected.
Two customers connected Hermes Agent to their WordPress sites before support existed. It worked, so it is official now: Hermes on the setup page, a one-click install, browser sign-in per site, one config for the whole fleet, and full attribution in the activity log.
One saved design direction per site: palette, fonts, spacing and the don’ts, written into the builder’s own token stores, enforced on every AI build, and verified against the real rendered page with screenshots attached. With a live pane showing the actual page converge as the agent works.
The Safety & Security hub watches WordPress core, plugin and WooCommerce advisories across every connected site and walks you through remediation. Included in the dashboard for paid plans, in Labs.
Your studio's name, logo, accent and support address on the plugin your clients open in wp-admin, with Respira gone from the plugins list and the front end. Display-only, fully reversible, set once and synced to every site. From €200 a year, and the early-adopter roadmap is public.
The working path from a Figma frame to a real WordPress page: the agent reads the node tree through Figma’s own MCP server, uploads the frame’s images to your media library, and rebuilds the layout in your builder’s native format. With three conversions you can open and inspect.
Every Respira site now carries a persistent memory for AI agents: conventions the agent honors in every session, and rules the plugin enforces at the write path. It also reads the Knowledge experiment WordPress core is building toward, on real production sites today.
The exact affected WordPress versions, what updating does and does not prove, which compromise indicators deserve investigation, and how Respira 8.1 turns a fleet scan into an approval-gated fix and verification receipt.
Showing 36 of 41 stories
Load more storiesGet the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
