Practical AI, webdev, and software signals for builders.
Latest useful updates from the open web: tools, releases, changelogs, WordPress, automation, AI coding, and small software signals worth noticing.
Updated from public feeds and lightly curated for practical builders. No hype feed. No voting. Just signals worth checking.
It is a small public signal board for Old Stack Journal. Items come from public feeds and sources, then get lightly curated so readers can spot useful AI, webdev, WordPress, tooling, automation, and software updates without wading through a noisy social feed.
Security signals.
Showing visible Radar cards in this category for the selected date range.
What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts
Wordfence 9.1.0 is now available. It adds the new Wordfence Security News Widget, which brings the latest WordPress security alerts and research to your dashboard, plus faster firewall rule updates, sharper request parsing, Live Traffic logging…
Read original →Say Yes To MCP, Safely A Guide For Governing AI Coding Agents With Evo ADS
Learn how to inventory MCP servers, assess risk, monitor policy impact, and block high-risk connections without disrupting developers. Evo ADS helps teams govern AI coding agents with confidence.
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure…
Read original →Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core
On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as…
Read original →Snyk Named a Leader in The Forrester Wave™: Agentic Development Security Tools, Q4 2026
Snyk is a Leader in The Forrester Wave™: Agentic Development Security Tools, Q4 2026, with the highest score in the strategy category.
Read original →Wordfence Price Increase Coming December 3, 2026
On Thursday, December 3, 2026, pricing for Wordfence Premium, Care, and Response will increase. We’re announcing this change a month in advance so you have time to purchase new licenses or renew eligible subscriptions at current…
Read original →HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. The post…
Read original →WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to…
Read original →Wordfence Bug Bounty Program Monthly Report – July 2026
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and…
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure…
Read original →PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
As of October 28, 2026, Wordfence knows of no WordPress site compromised through PHP2Shell. Update PHP to a fixed version and restart it, because updating WordPress does not update PHP. The post PHP2Shell Update: Still No…
Read original →PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.
PHP2Shell showed how quickly an engine-level flaw can put internet-facing applications at risk. Learn why outside-in inventory, rapid testing, and repeat checks matter before the next disclosure.
Read original →Snyk UNFILTERED: Inside Our First-Ever Customer Summit
At Snyk’s first customer summit, security leaders shared candid perspectives on AI risk, vulnerability remediation, and governing autonomous agents. Five themes reveal how teams are adapting security for AI speed.
Read original →Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem
The Wordfence Threat Response Team is a new small, technically hands-on team responsible for turning rapidly emerging threats into customer protection and clear customer guidance. Spot an active threat? Report it directly to threat-response@wordfence.com The post…
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure…
Read original →Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the…
Read original →Turn Your Vulnerability Backlog Into Pull Requests With Agentic Remediation
The Evo Remediation Agent is now in Open Preview, bringing automated dependency resolution to Evo Agentic AppSec. AppSec teams can now run ongoing remediation
Read original →PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now
Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.
Read original →Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP…
Read original →PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We recommend making sure every site you manage is running…
Read original →AI Model Risk Depends on What the Model Can Reach
A model’s risk score is only part of the picture: its impact depends on the data, tools, and actions its application can reach. Learn how security teams can verify that reach and choose targeted controls.
Read original →AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered
AI is making attacks cheaper and faster, exposing risks organizations already carry. Four security leaders share why machine-speed defense and faster remediation are now essential.
Read original →PSA: Upcoming Critical PHP Security Release
The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on…
Read original →Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator
Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer. The post Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator appeared…
Read original →PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites
TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone,…
Read original →PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02…
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security…
Read original →600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access…
Read original →VulnBump: Can AI Agents Fix Vulnerable Dependencies Without Breaking the Build?
VulnBump tests AI agents on 307 real dependency upgrades. A fix counts only if the vulnerability is gone and the build and tests stay green.
Read original →Introducing Evo Agentic AppSec: Security That Keeps Up With AI Development
AI-driven development is outpacing traditional security workflows. Snyk’s Agentic AppSec uses security agents to find, fix, and verify vulnerabilities continuously, while humans set the bar.
Read original →Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
On September 8, 2026, Artifex released Ghostscript 10.08.0, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported sixteen days earlier. It is tracked as CVE-2026-39919 and carries…
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure…
Read original →Cybersecurity Imperatives Will Demand AI Math
Cybersecurity is built on math, and if public key encryption falls and we don’t have a replacement ready, the Web grinds to a halt. The post Cybersecurity Imperatives Will Demand AI Math appeared first on Wordfence.
Read original →Frontier models found the vulnerabilities. Only the attacker found the chains.
Static analysis found the flaws, but only live attack testing proved how they could be chained into breaches. A comparison of Evo COS, Claude Security, and Claude Code Security.
Read original →Autonomous Attacks Are Already Here. The Defense Has to Match Their Speed.
Autonomous attackers are shrinking the window for defense. Learn how continuous discovery, remediation, validation, and prevention can help security teams keep pace.
Read original →Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Last week, there were disclosed in that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your…
Read original →