DEV Community: Vijay Mishra

Record Patch Tuesday, a BeyondTrust Zero-Day and a WordPress Supply Chain Attack: What to Patch This Week

Vijay Mishra — Thu, 22 Oct 2026 20:06:41 +0000

If you only skim one security update this week, make it this one. October 2026 has been busy: Microsoft shipped its biggest Patch Tuesday ever, a China-linked group was caught using a zero-day in remote support software, and a popular WordPress SEO plugin was briefly shipped with malware inside it.

I already covered the PHP2Shell flaws in my previous post, so this roundup looks at what else is making headlines. Here is what happened, in plain language, and what you can do about it today.

1. Microsoft's record October Patch Tuesday

On October 13, Microsoft released fixes for 1,411 vulnerabilities, which BleepingComputer describes as a record. About 70 of them are rated Critical, and most of those are remote code execution bugs. Three are zero-days:

CVE-2026-96951 is a Windows Shell flaw that bypasses Mark of the Web, the warning Windows shows on files downloaded from the internet. It is the one confirmed as actively exploited.
CVE-2026-108398 is a .NET Framework bypass that can sidestep Windows Defender Application Control. It was found by Google Project Zero's James Forshaw and was publicly disclosed before the fix.
CVE-2026-92707 is a denial-of-service issue in MessagePack-CSharp, rated Moderate.

What to do: install the October updates, starting with internet-facing servers and domain controllers. If you manage a lot of machines, prioritise the actively exploited one first.

2. BeyondTrust Remote Support zero-day (CVE-2026-102764)

CISA added this authentication bypass to its Known Exploited Vulnerabilities catalog on October 16. It carries a CVSS score of 9.3 and affects Remote Support and Privileged Remote Access versions 24.3.1 through 26.2.3. An unauthenticated attacker can perform arbitrary file operations, which can lead to full root access.

Reports tie the exploitation to a China-nexus espionage group tracked as UNC5221 and WARP PANDA, with activity going back to late August. BeyondTrust's cloud instances were patched on October 8, but self-hosted appliances need a manual update (advisory BT26-05).

What to do: update self-hosted appliances now. Patching does not remove a webshell that is already planted, so also review logs and look for unknown files or tunnels.

3. Rank Math PRO supply chain attack

This one matters to a lot of WordPress site owners. Rank Math reported that attackers injected malware into Rank Math PRO version 3.0.123, available between October 15 (20:02 UTC) and October 16 (07:12 UTC). Rank Math pulled the files and released a clean 3.0.124.

The malicious code could give attackers persistent access, expose credentials and API keys, recreate a hidden backdoor on page visits, and even modify other plugins and themes.

What to do:

Check whether 3.0.123 was installed and active during that window.
If it was, treat the site as compromised. Restoring a clean backup from before the incident is the safest route.
Look for unknown admin users, odd .cache files, changes to .htaccess and new cron jobs.
Rotate all passwords and API keys, then install 3.0.124 or newer.

4. Bricksforge: a CVSS 10.0 WordPress plugin flaw

Bricksforge (CVE-2026-85097) allows unauthenticated attackers to upload a disguised PHP file through its form handling and run it on the server. Patchstack has seen automated attacks from dozens of IP addresses. Versions up to 3.1.8.9 are affected. Update to the latest release from the vendor, and check /wp-content/uploads/bricksforge/tmp/ for PHP files that should not be there.

5. A WordPress backdoor that rebuilds itself

Sucuri documented a backdoor that stores copies of itself in at least eight places, including drop-ins, theme files, the database and even shared memory on some servers. Delete one copy and the others rebuild it. It can also create a hidden administrator and inject JavaScript to skim payment details from visitors.

The lesson is that cleanup has to be complete. If you suspect an infection, work with your host, check every location, and restart the server so memory-resident copies are cleared. Sucuri also notes that wpForo versions up to 2.4.14 have an actively exploited SQL injection flaw (CVE-2026-1581), so update that plugin if you use it.

The trends behind the headlines

Volume is exploding. A record Patch Tuesday means patch triage matters more than patching everything at once.
Supply chain attacks are the new normal. Even a trusted premium plugin update can be poisoned for a few hours.
Remote access tools are favourite targets. Espionage groups keep going after appliances that sit on the network edge.
Persistence beats cleanup. Attackers now plan for you deleting a file.

A simple weekend checklist

Install the October Windows updates and verify them.
Update BeyondTrust if you self-host it.
Check Rank Math PRO, Bricksforge and wpForo versions.
Turn on automatic backups and keep one copy off the server.
Delay plugin auto-updates by a day for critical sites, so a bad release can be caught first.
Use a security plugin or host-level scanning and review admin users.

Staying safe does not need perfect effort. A few steady habits cover most of the risk.

Need help securing or cleaning a WordPress site? Visit expertwebdeveloper.in or growsmartwithai.com. This roundup is also on expertwebdeveloper.in, Grow Smart with AI, Medium, Substack and LinkedIn.

Sources: BleepingComputer on October Patch Tuesday · BeyondTrust CVE-2026-102764 analysis · SecurityWeek on Rank Math PRO · The Hacker News on Bricksforge · The Hacker News on the self-rebuilding backdoor

WordPress, Drupal and PHP security this week: what to patch now

Vijay Mishra — Wed, 21 Oct 2026 15:49:16 +0000

Three security items from the past two weeks matter if you run WordPress or Drupal. Everything below is as reported on October 21, 2026, so please confirm the details on the official pages before you act.

PHP: two critical flaws, now patched

PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Reports say a single unauthenticated request can trigger them, and any PHP setup that serves web requests is affected. At the time of writing, no confirmed attacks in the wild have been reported.

What to do: update PHP, or install the patched package from your host or Linux distribution. If you are still on PHP 8.1 or older, ask your host about a backport or move to a supported version.

WordPress: Bricksforge plugin, CVE-2026-85097

This add-on for the Bricks builder has a CVSS 10.0 flaw in its form file upload handling that lets an unauthenticated attacker run code. Versions up to 3.1.8.9 are affected, and Patchstack reported attacks from October 7. Sources differ on the exact fixed version number, so update to the newest release in your dashboard. After updating, look for unexpected PHP files in the plugin's tmp folder under wp-content/uploads and review your form submission logs.

Drupal: Field UI remote code execution, CVE-2026-108097

Published on October 14 as SA-CORE-2026-014 and rated critical. Core alone is not directly exploitable, but contributed modules or custom code can expose it. Update to Drupal 11.4.10, 11.3.19 or 10.6.19. If you cannot update right away, uninstall the Field UI module after checking dependencies. A related contributed module issue, Entity List (SA-CONTRIB-2026-218), is fixed in version 3.0.10. Drupal 8, 9, 10.5 and earlier, and 11.2 and earlier no longer get security fixes, so those sites need to move to a supported branch.

A simple protection routine

Take a backup first, test updates on staging, update PHP and plugins or modules before anything else, then core, and check key pages and forms afterwards. Remove plugins and modules you do not use, give admin access only to people who need it, keep a web application firewall in front of the site, and watch for new or changed files after every incident like this.

Which of these are you patching first? I would love to hear how your updates go.

Also on Medium. More WordPress and web security notes at expertwebdeveloper.in

A 5-step checklist I use before accepting AI-written code

Vijay Mishra — Wed, 21 Oct 2026 12:21:49 +0000

AI assistants can write code in seconds, but speed only helps if you can trust what lands in your project. Here is the short checklist I run through every time.

Read it like a pull request from a new teammate. Don't paste and move on. Read every line and ask whether you could explain it to someone else.
Ask for the smallest change. A small diff is easy to review. A big rewrite hides problems, so I prefer one function or one fix at a time.
Run it and try the awkward cases. Empty input, wrong types, very large input. Working on the happy path is only the start.
Check that the functions and options it mentions really exist. Open the official docs and confirm. It takes a minute and saves an afternoon of confusion.
Commit often. Small commits mean you can roll back a bad suggestion without losing good work.

None of this slows me down much, and it keeps the code in my projects something I understand. What does your own review routine look like? I'd love to hear it.

Also on Medium. More web development notes at expertwebdeveloper.in

WordPress in late 2026: what's new since 7.0 and what to check before you update

Vijay Mishra — Tue, 20 Oct 2026 07:20:03 +0000

WordPress has moved fast this year. Version 7.0 arrived on May 20 and 7.1 followed on August 19, so if you look after client sites, here is a plain summary of what matters.

AI in core, on your terms. 7.0 added a provider agnostic AI client and a Connectors screen, so plugins can talk to AI services through one standard setup. API keys for providers such as OpenAI, Anthropic and Google are supported. It's all optional, and a good habit is to treat anything it writes, like titles or alt text, as a first draft.

Responsive styling without custom CSS. In 7.1 you can set block styles per viewport (tablet and mobile) in the Site Editor, and developers can define custom breakpoints in theme.json. Hover, focus and active states start with the Button block. For many small sites that means fewer custom CSS files to maintain.

Better teamwork. Notes bring asynchronous comments with a suggestion mode to the editor. Real time co-editing is still behind feature flags, so I wouldn't promise it to clients yet.

The Classic block stays. The plan to remove it from the inserter was reversed in July, which is good news for older content.

Two housekeeping items for developers. Blocks that use an older Block API version may misbehave in the iframed editor, so check that your custom blocks declare apiVersion 3. React 19 is also expected to become the default in a later release, so now is a good time to test your plugins.

My update routine is simple: take a backup, test on staging, update plugins and theme first, then core, and check your key pages and forms afterward.

What are you most looking forward to in 7.1? I'd love to hear what you noticed first.

Originally published on Substack. I also write on Medium. More WordPress notes at expertwebdeveloper.in.

WordPress 7.1 for Developers: What Shipped and What Didn't

Vijay Mishra — Mon, 19 Oct 2026 15:25:04 +0000

Originally published on Substack. I also write on Medium (profile). More WordPress work at expertwebdeveloper.in.

WordPress 7.1, code-named "Mary Lou", was released on August 19, 2026. Release notes can read like a long list, so here is a shorter way to look at it as a WordPress developer: what you can actually use now, and what was discussed during the cycle but did not make it into the release.

What shipped for developers

Based on coverage from Raidboxes and Wordify, these are the changes that matter most for people who build and maintain sites.

Icons API. register_icon() and unregister_icon() let agencies and product developers add their own icon sets, with SVG sanitisation and namespace validation.
AI Client and Connectors. The PHP AI Client adds generation streaming and embeddings. Connectors can now authenticate with a username and application password, not only API keys.
Block Bindings. List items and nested blocks can be bound to dynamic data sources, and Advanced Custom Fields and Meta Box bindings are included by default.
REST API batch requests. Several REST requests can be combined into a single HTTP request.
Responsive styling. Theme authors can set Tablet and Mobile breakpoints in theme.json, and hover, focus and active styles are editor controls for the Button and Navigation Link blocks.
Media. Images can be processed in the browser before upload, with support for HEIC, Ultra HDR, AVIF and WebP. Firefox and Safari keep using the server-side path.
Editor and blocks. Notes with @mentions and email notifications, a command palette, and new Tabs and Playlist blocks.

What did not ship

According to Wordify, several items that appeared on the roadmap are not in the final release.

Real-time collaboration was tested but is not enabled.
The Table of Contents block, which was on the June roadmap, is not included.
React 19 in Core was postponed, and the experiment continues in the Gutenberg plugin.
Guidelines changed during the cycle and is not a finished user-facing feature.
The planned change to hide the Classic block from the inserter was reverted.

The official 7.1 roadmap itself warned that planned items do not necessarily make it into the final release. That is worth remembering whenever a feature is announced early.

What I would check before updating a client site

This is my own checklist, not an official one.

Test on a staging copy first, including checkout and forms.
If a theme sets its own responsive styles, check how the new Tablet and Mobile breakpoints in theme.json interact with them.
If a project was waiting for the Table of Contents block or real-time collaboration, keep the current plugin or workflow, because neither is in this release.
If a plugin talks to AI services, check whether streaming or the new Connectors authentication options simplify it.
Re-test image uploads in more than one browser, since the in-browser processing is not used in Firefox and Safari.

The takeaway

A release is more than its headline features. What shipped is a set of practical tools: icons, bindings, request batching and responsive controls. What did not ship is just as useful to know when you plan client work.

Which change in 7.1 will you use first?

I'm Vijay Mishra, a WordPress developer. I work on production WordPress sites, and you can find my services, case studies and blog at expertwebdeveloper.in.

Sources: Raidboxes, Wordify, Make WordPress Core: Roadmap to 7.1.

Faster Code Is Not the Same as Shipped Code

Vijay Mishra — Sun, 18 Oct 2026 00:03:49 +0000

Originally published on Substack. I also write on Medium (profile) and Substack.

AI coding tools have changed how quickly I can get a first version of something on the screen. For a WordPress developer, that means a plugin skeleton, a block, or a tricky query can appear in a few seconds. But the faster the first draft arrives, the more obvious it becomes where the real work sits: checking it.

Sonar's 2026 State of Code Developer Survey puts numbers on this. Among developers who have tried AI coding tools, 72% now use them every day. Yet 96% say they do not fully trust that AI-generated code is functionally correct, and only 48% say they always check AI-assisted code before committing it. Sonar calls the result a verification bottleneck: writing code got faster, but the gains many people expected have not followed, because someone still has to confirm the code works.

That matches my own experience. The time I save typing, I spend reading.

Why review becomes the job

When I write code myself, I understand every line because I made every decision. When an AI agent writes it, the code can look clean and still be wrong in ways that are easy to miss: a missing capability check, an unescaped output, a query that works on a small site and falls apart on a large one. In WordPress, these small misses matter, because plugins run on other people's sites.

The gap between the 96% who doubt AI code and the 48% who always check it is the part worth thinking about. Most of us know we should verify. Fewer of us do it every time.

A simple routine that helps

Here is what I try to follow, and it is not complicated.

I keep changes small. A small diff is a diff I can actually understand. A giant AI-generated change invites a quick skim and a hopeful merge.
I read the code before I run it. If I cannot explain what a function does, it does not get committed.
I test the behavior, not just the syntax. Code that runs without errors is not the same as code that does the right thing.
I check security-sensitive spots by hand: input handling, output escaping, permissions, and database queries.
I keep the decisions myself. AI can suggest an approach, but I choose the architecture and I own the result.

The takeaway

AI did not remove the hard part of software development. It moved it. The skill that matters more now is not typing speed, it is judgment: knowing what to keep, what to change, and what to throw away.

If AI helps you write code faster, make sure the saved time goes into reviewing it properly. Faster code only counts once it is code you can trust.

I would like to hear how you handle this. Do you review every AI-generated change, or do you rely on tests to catch problems?

Source: Sonar, 2026 State of Code Developer Survey results (community.sonarsource.com).

FSE WordPress 2026: Innovations in Theme Development

Vijay Mishra — Thu, 10 Sep 2026 17:58:31 +0000

The landscape of WordPress theme development is evolving rapidly, especially with the introduction of Full Site Editing (FSE) and enhanced AI capabilities in WordPress 2026. As an expert consultant, I see these advancements not just as trends but as essential components shaping the future of website design and development.

Understanding FSE in WordPress 2026

Full Site Editing is a major shift for WordPress. It allows developers and users to edit every aspect of their site using blocks, which promotes a modular approach to design. This means that instead of being confined to static templates, we can create dynamic layouts that can be easily modified.

For instance, consider the ability to customize headers, footers, and sidebars directly within the WordPress editor. This level of control enhances user engagement and makes it easier for businesses to adapt their sites to changing needs. The new capabilities in WordPress 7.0 and 7.1 further empower developers to build more streamlined and interactive themes.

AI Integrations in WordPress 7.0

The introduction of AI Client/Connectors in WordPress 7.0 is transforming the way we approach theme development. These connectors enable developers to integrate AI functionalities seamlessly into their themes. For example, imagine a theme that can automatically suggest design adjustments based on user behavior or content trends. This not only saves time but also enhances the user experience by delivering personalized content.

Moreover, AI tools can assist in optimizing performance, ensuring that themes load quickly and efficiently. This is crucial for maintaining excellent Core Web Vitals scores, which are increasingly important for SEO and user satisfaction.

Upgrades in the 7.1 Editor and Abilities API

With the release of WordPress 7.1, the new editor introduces a host of features designed to improve usability and accessibility. The updates to the Abilities API allow for more granular control over capabilities within themes. This means that developers can create more sophisticated user roles and permissions directly tied to the theme’s functionality.

For example, a membership site can utilize these updates to restrict certain content based on user roles, enhancing the overall site experience. This level of customization was previously challenging to implement but is now more manageable with the new tools provided.

Practical Considerations for Theme Development

As a consultant, I advise my clients to embrace FSE and AI features in their theme development strategies. Here are a few practical steps to consider:

Stay Updated: Regularly check for updates on WordPress developer documentation to understand new features and best practices.
Experiment with Blocks: Leverage the block system to create reusable components that can be used across various projects, saving development time.
Integrate AI: Explore AI-driven plugins that can automate tasks, enhance user engagement, and provide insights into user behavior.
Focus on Performance: Optimize your themes for speed and accessibility, aligning with the Core Web Vitals metrics to ensure a smooth user experience.
Engage with the Community: Participate in discussions on platforms like make.wordpress.org to learn from other developers and share your insights.

Conclusion

The advancements in FSE and AI integration in WordPress 2026 present significant opportunities for theme developers. By adapting to these changes, you can create themes that are not only visually appealing but also functionally robust and user-centric. As we move forward, the focus should be on leveraging these tools to build better experiences for users while streamlining the development process.

If you’re interested in enhancing your WordPress theme development skills, I recommend checking out my post on Mastering WordPress Theme Development. For personalized consulting on your next project, feel free to Contact me.

If you want this applied on a live site, I can walk through it via Theme Development consulting.

Originally published at https://expertwebdeveloper.in/blog/fse-wordpress-2026-innovations-theme-development/.

WordPress 7.1 Latest News: Key Features and Updates

Vijay Mishra — Wed, 09 Sep 2026 08:40:48 +0000

As an expert consultant with extensive experience in WordPress, I find the recent releases particularly noteworthy. WordPress 7.1, codenamed "Mary Lou," was officially released on August 19, 2026, and brings a host of enhancements that are crucial for developers and product managers alike. This update follows the launch of WordPress 7.0, which introduced the AI Client and Connectors API.

Key Features in WordPress 7.1

WordPress 7.1 is packed with features that cater to modern web development needs. Here are some of the standout updates:

Responsive Block Styles: This update allows developers to create blocks that adapt seamlessly to different screen sizes. This is essential for maintaining a consistent user experience across devices. The flexibility of responsive design is no longer a luxury; it’s a necessity.
Redesigned Media Editor: The media editor has undergone a significant overhaul, making it easier to manage and edit media files. This improvement streamlines workflows, especially for content-heavy sites where media management can become cumbersome.
Client-Side Image Processing: This feature enhances performance by allowing image processing to occur on the client side. It reduces server load and improves page load times, which is critical for user engagement and SEO.
Richer Notes/@mentions: The introduction of richer notes and @mentions enhances collaboration within WordPress. This is particularly useful for teams working on large projects where communication is key.
Abilities API Validation/Schema Improvements: The Abilities API has seen improvements in validation and schema, making it easier for developers to implement and manage capabilities within their applications. This is a vital enhancement for any enterprise-level project where permissions and roles are complex.

AI Client and Connectors API

The AI Client introduced in WordPress 7.0 has set the stage for more intelligent integrations. The Connectors API allows for seamless communication between WordPress and other services, making it easier to pull in data from third-party applications.

For example, if you are building a site that requires real-time data from an external service, the Connectors API simplifies that process. This is particularly useful for e-commerce platforms or applications that rely on dynamic content.

Practical Implications for WordPress Core Teams

For WordPress Core teams, these updates are more than just new features; they represent a shift in how we approach web development. Here are some practical takeaways:

Adopt Responsive Design Early: With responsive block styles now available, it's advisable to start incorporating these into your themes and plugins. This will not only improve user experience but also future-proof your projects against evolving design standards.
Leverage Client-Side Processing: Utilize client-side image processing to enhance performance. This can significantly reduce server costs and improve load times, which is essential for retaining users and improving SEO rankings.
Enhance Collaboration: Use the new notes and @mentions features to facilitate better communication among team members. This can streamline project management and reduce misunderstandings.
Implement Abilities API Improvements: Take advantage of the enhancements in the Abilities API to create more robust permission systems. This is particularly important for enterprise applications where user roles can be complex.

Conclusion

The advancements in WordPress 7.1, alongside the foundational changes introduced in 7.0, reflect a growing trend towards more intelligent, responsive, and collaborative web applications. As WordPress continues to evolve, staying updated with these features will be crucial for developers and product managers aiming to leverage the platform effectively.

For a deeper understanding of these updates, I recommend reviewing the official WordPress 7.1 Field Guide and the Abilities API Improvements.

If you need further assistance in implementing these features or have any questions, feel free to Contact me. For more insights, check out related posts such as WordPress Latest News 2026: AI Client and 7.1 Updates and Exploring WordPress 7.1 Abilities API Trends in 2026.

Stay ahead in your WordPress development journey by keeping these updates in mind and integrating them into your workflows.

If you want this applied on a live site, I can walk through it via WordPress Core consulting.

Originally published at WordPress 7.1 Latest News: Key Features and Updates. Set that URL as the Medium canonical link.

Originally published at https://expertwebdeveloper.in/blog/wordpress-7-1-latest-news-key-features-updates/

WordPress Latest News 2026: AI Client and 7.1 Updates

Vijay Mishra — Tue, 08 Sep 2026 20:09:10 +0000

As of 2026, the WordPress ecosystem has seen significant advancements, particularly with the release of WordPress 7.0 and 7.1. These updates not only enhance core functionality but also integrate AI capabilities that can transform user experiences and development processes.

WordPress 7.0: AI Client and Connectors API

The introduction of the WordPress 7.0 AI Client marks a pivotal shift in how WordPress interfaces with its users. This client serves as a bridge for AI-driven features, allowing developers to leverage machine learning and natural language processing in their applications. The Connectors API enables seamless integration with third-party services, making it easier to pull in data or services from external platforms.

Continue reading on the site: https://expertwebdeveloper.in/blog/wordpress-latest-news-2026-ai-client-7-1/

canonical_url: https://expertwebdeveloper.in/blog/wordpress-latest-news-2026-ai-client-7-1/