The Holocron
Field notes & deep dives
Everything we have learned rescuing, rebuilding and speeding up WordPress sites.
FeaturedWordPress News: Critical Core Patch and a Hidden Server Bug (Week of 3 November 2026)
WordPress 7.1.4 patches an RCE already under attack, and a separate Brotli flaw can crash sites through pingback requests.
WordPress NewsWordPress News: Critical PHP Flaw Demands Action (Week of 27 October 2026)
A critical, actively probed PHP vulnerability and a high severity Duplicator plugin bug both demand attention this week, no matter who hosts your site.
WordPress NewsWordPress News: Three Plugin Vulnerabilities Patched (Week of 6 October 2026)
A critical, unauthenticated flaw in Beaver Builder (CVSS 9.1) leads this week's patches. Update now if you run this popular page builder.
WordPress NewsWordPress News: Two Plugin Updates You Can't Skip (Week of 22 September 2026)
A critical remote code execution flaw in Tutor LMS and a WooCommerce security release both landed this week. Here's what to actually do about them.
WordPress NewsWordPress News: Two Plugin RCE Flaws Patched (Week of 15 September 2026)
A critical remote code execution flaw in Tutor LMS and a file inclusion bug in GEO my WP both got patched this week. Update both plugins now.
WordPress NewsWordPress News: Critical Migration Plugin Flaw Patched (Week of 8 September 2026)
A critical SQL injection hit a backup plugin used on 5 million sites this week, plus a big WooCommerce update landed. Here's what matters.
WordPress NewsWordPress News: Critical Plugin and Theme Vulnerabilities Patched (Week of 1 September 2026)
A critical, unauthenticated RCE chain in the best-selling Avada theme headlines this week: if you run it, update now. Two more stories worth five minutes of your time.
WordPress NewsWordPress News: Critical Plugin Bugs, Major Core Release (Week of 25 August 2026)
Critical bugs in Pods and Elementor Pro can hand attackers admin access; WordPress 7.1 also shipped this week. Here's what to do about both.
WordPress NewsWordPress News: Security Patches and a Major Release (Week of 18 August 2026)
WordPress core shipped two security fixes this week, a critical plugin bug hit 40,000 sites, and WordPress 7.1 launches this Wednesday.
WordPress NewsWordPress News: Supply Chain Attacks and Critical Patches (Week of 11 August 2026)
A poisoned plugin vendor's API and a critical WordPress security release make this a week worth paying attention to. Here's what needs doing, and what doesn't.