WordPress 6.9.2 landed on March 11, 2026 with fixes for ten vulnerabilities, among them blind SSRF, a PoP chain in the HTML API and an XXE in getID3. What each one lets an attacker do, and how to ship the update with WP-CLI.
Core was tagging hidden Gutenberg images as high priority and hurting LCP. Ticket #64823 fixes that, and Performance Lab is dropping Web Worker Offloading after 6,000 updates with no feedback.
RHF and Zod handle flat CRUD forms well, but branching logic leaks across the schema, the state and the JSX. Where SurveyJS keeps those rules instead, and how to pick between the two.
Intel’s Gaudi accelerators lost half their throughput on AWS DL1 because every byte detoured through host DRAM. This is how Peer Direct, libfabric and DMA-BUF put that data path back on the network.
Quantum machine learning is not fast AI. It changes how data is represented, from bits and floats to amplitudes you can only read by measuring, and most quantum-inspired pipelines are not QML at all.
Claude Skills keep instructions in files the agent reads only when needed, which cuts the token overhead of always-on MCP tools. Subagents push it further by throwing away their own context once the job is done.
AI-generated code ships fast and then stalls, usually around month three, when nobody can safely change the file it all lives in. A WooCommerce example shows the monolith version next to the decoupled one.
WordPress is featuring eight plugins every two weeks, picked from those with under 10,000 installs and less than a year in the directory. What the criteria check, and the code cleanup worth doing first.
Almost every WordPress vulnerability comes from a plugin or theme, not from core. Where the risk actually sits, the hardening I put on sites I manage, and the maintenance habits that keep them clean.
CVE-2026-3589 is a CSRF flaw in the WooCommerce Store API, affecting versions 5.4 to 10.5.2, that can be used to create admin accounts through batch requests. How the flaw works, and how to check your own version with WP-CLI or a small PHP snippet.