The Holocron
Field notes & deep dives
Everything we have learned rescuing, rebuilding and speeding up WordPress sites.
FeaturedWordPress News: Two Plugin RCE Flaws Patched (Week of 15 September 2026)
A critical remote code execution flaw in Tutor LMS and a file inclusion bug in GEO my WP both got patched this week. Update both plugins now.
WordPress NewsWordPress News: Critical Migration Plugin Flaw Patched (Week of 8 September 2026)
A critical SQL injection hit a backup plugin used on 5 million sites this week, plus a big WooCommerce update landed. Here's what matters.
WordPress NewsWordPress News: Critical Plugin and Theme Vulnerabilities Patched (Week of 1 September 2026)
A critical, unauthenticated RCE chain in the best-selling Avada theme headlines this week: if you run it, update now. Two more stories worth five minutes of your time.
WordPress NewsWordPress News: Critical Plugin Bugs, Major Core Release (Week of 25 August 2026)
Critical bugs in Pods and Elementor Pro can hand attackers admin access; WordPress 7.1 also shipped this week. Here's what to do about both.
WordPress NewsWordPress News: Security Patches and a Major Release (Week of 18 August 2026)
WordPress core shipped two security fixes this week, a critical plugin bug hit 40,000 sites, and WordPress 7.1 launches this Wednesday.
WordPress NewsWordPress News: Supply Chain Attacks and Critical Patches (Week of 11 August 2026)
A poisoned plugin vendor's API and a critical WordPress security release make this a week worth paying attention to. Here's what needs doing, and what doesn't.
WordPress NewsWordPress News: Critical Core Exploit, WooCommerce 11.0 (Week of 28 July 2026)
WordPress core is under active attack from a chained exploit called wp2shell. If your site is not on 7.0.2, 6.9.5, or 6.8.6, update today.
WordPress NewsWordPress News: Two Critical Vulnerabilities This Week (Week of 4 August 2026)
A deliberate backdoor in a popular plugin and a critical WooCommerce login flaw made this a week for checking your site, not just updating it.
WordPress NewsWordPress News: Critical Core Vulnerability Patched (Week of 21 July 2026)
WordPress patched a critical remote code execution flaw this week, and attackers are already exploiting it. Here's what needs updating right now.
WordPress NewsWordPress News: Security Patches, Core Updates, WooCommerce Growth (Week of 13 July 2026)
Blocksy's critical plugin flaw is already patched, WordPress 7.0.1 fixes bugs, and WooCommerce 11.0 is coming. Here's what actually needs your attention this week.