ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

WordPress.org

2 mentions in 7 days · 2 in 30 days · 3 total · first seen · last

Search everything

Timeline

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.

Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.

Cyber Security Newsupdated · 4d agofirst · 5d agoTools 7 sources

Automattic's board forces CEO Matt Mullenweg into leave of absence

Automattic's board voted to place CEO Matt Mullenweg on paid leave against his will, naming CFO Mark Davies interim CEO of WordPress's parent company.

Automattic's board voted to put founder and CEO Matt Mullenweg on paid leave against his will, with CFO Mark Davies appointed interim CEO; Mullenweg remains on the board. The move follows years of turmoil, including a protracted legal battle with WP Engine, a 2024 ultimatum in which 159 employees took severance, and a 16% staff layoff in April 2025. WordPress.org's executive director said the open-source WordPress project and its teams continue as planned and are not impacted. Automattic also owns Tumblr, WooCommerce, and Pocket Casts.

Hacker News · securityupdated · 4d agofirst · 5d agoOther 7 sourcesHN 23↑ · 99 comments

WordPress 7.0.4 Release

WordPress releases 7.0.4 with a security fix and urges all sites to update immediately.

WordPress.org announced the availability of WordPress 7.0.4, a maintenance release containing a security fix. Because it is a security release, the project recommends updating sites immediately via the dashboard or a download from WordPress.org. The announcement gives no technical details about the flaw being patched.

WordPress.org · Security · Aug 12, 2026Advisory

Appears with

product WordPress 3vendor WordPress 2vendor Automattic 2organization Wordfence 1organization WordPress Foundation 1organization WP Engine 1product Jetpack Scan 1product Pocket Casts 1product Tumblr 1product WooCommerce 1vendor Wordfence 1vendor WordPress.org 1organization 404 Media 1vendor WP Engine 1organization Automattic 1organization TechCrunch 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.