WordPress 6.9.2 shipped without three of its ten security commits, then broke classic themes that return stringable objects from template_include. What happened across 6.9.3 and 6.9.4, and what the Core team is changing about the process.
Overflow clipping and stacking contexts, not z-index, are what break action menus inside scrollable tables. Portals, CSS anchor positioning and the Popover API each solve a different part of the problem.
The Add to Cart with Options block compared hyphenated slugs against labels with spaces, so variable product selections failed validation. WooCommerce 10.6.1 fixes that, reorders new payment gateways, and drops the stray number from single shipment labels.
WordPress 6.9.4 re-applies three security fixes that 6.9.2 and 6.9.3 left incomplete: PclZip path traversal, XXE in getID3, and a Notes authorization bypass. It also covers the WP-CLI commands I use to update core and check the files afterwards.
Weighted BCE starves when fraud is 0.2% of your data. I walk through adding a differentiable rule loss in PyTorch, what it does to ROC-AUC, and why both models need thresholds tuned the same way.
WordPress 6.9.3 is a fast-follow fix for a 6.9.2 regression that blanked out sites whose themes returned stringable objects to template_include. Here is what broke, and what you need to update.
WordPress 6.9.2 landed on March 11, 2026 with fixes for ten vulnerabilities, among them blind SSRF, a PoP chain in the HTML API and an XXE in getID3. What each one lets an attacker do, and how to ship the update with WP-CLI.
Core was tagging hidden Gutenberg images as high priority and hurting LCP. Ticket #64823 fixes that, and Performance Lab is dropping Web Worker Offloading after 6,000 updates with no feedback.
Magic numbers like z-index: 99999 are guesses. How I set up z-index tokens in CSS variables, pair a modal with its backdrop using calc(), and use isolation to keep a component’s layering inside the component.
Almost every WordPress vulnerability comes from a plugin or theme, not from core. Where the risk actually sits, the hardening I put on sites I manage, and the maintenance habits that keep them clean.