As AI revolutionizes cybersecurity, organizations struggle with rapid vulnerability detection versus slow human remediation. Balancing efficiency and accountability is crucial, as maintaining human oversight prevents potentially catastrophic errors.

Howdy, Before anything else: check which version of PHP your sites run. On October 21, the PHP project released fixes for two critical vulnerabilities, and they affect any server running a PHP application, not only WordPress. You’ll find your version under Tools → Site Health → Info → Server in your WordPress admin. If you manage your own server and are still on a version older than 8.2, I highly recommend updating. While many hosts have patched older PHP versions that are end of life, it’s best to stay on versions that PHP officially supports. On a happier note, I’m back. I was sick for a stretch earlier this month, which is why there was no edition on October 10. Rather than try to cram four weeks into one post, this edition sticks to the last two. Much of what happened in the gap is covered in my October roundup for developers, linked below. With that, let’s get down to the latest news. Your friendly neighborhood developer advocate, Justin Tadlock Table of Contents Developing Gutenberg and WordPressPlugins, Themes, and Tools for #nocode site builders and ownersTheme Development for Full Site Editing and BlocksBuilding Blocks and Tools for the Block editor.What’s new in Playground?AI in WordPress Developing Gutenberg and WordPress The final major release of the year has entered testing. David Baumwald announced that WordPress 7.2 Beta 1 is ready for download and testing, with the final release set for December 8. Notes move into a margin beside the canvas and pick up emoji reactions. Text shadows and form element styling arrive in the design tools, a new Secrets API gives plugins a standard place to store API keys, and client-side media processing extends to the Media Library. There’s even an On This Day dashboard widget. Not everything made it, though: The Repository reports that Notes suggestion mode was punted to 7.3. The quickest way to try it is the 7.2 Beta 1 Playground instance, or wp core update –version=7.2-beta1 on a test site. Not on production. Not sure where to start? Noruzzaman’s Help Test WordPress 7.2 breaks the release down by area: security, collaboration, admin, blocks and APIs, design, media. It also walks through the different ways to run a beta, from Playground to a staging site on your host, and points you to where feedback goes. The Beta 1 post is clear that testing counts as contributing, whether or not you’ve done it before. Your first contribution to WordPress shouldn’t start with installing Git, Node.js, npm, and Docker. That’s the friction the WordPress Contributor Toolkit removes, and Ryan Welcher announced Contributor Toolkit 2.0, a redesigned app in your language. It’s rebuilt on the WordPress Design System, ships in ten languages, and adds a settings dialog. After you apply a patch, you can revert a single file without losing the patch itself. It’s also about 350 MB smaller, which helps when a whole Contributor Day room downloads it at once. Jorge Costa shared what’s new in Gutenberg 24.2, and the Notes feature is the big headline. Notes now float in a margin the editor reserves next to the canvas, so you no longer have to choose between reading feedback and keeping the Settings sidebar open. The Navigation block’s link search now looks through pages, posts, categories, and tags at once. Gallery can sort hand-picked images and tint all of them with a single duotone. And the design tools push continues with about 80 more PRs. Minimum width and height controls, for example, went from five blocks to 40. For developers, React 19 is now on by default. Test your plugins and themes, and if something breaks, you can switch it off under Gutenberg → Experiments. Gutenberg 24.3 RC1 is already out, too, with rich text formatting across blocks, so expect that next week. On the Developer Blog, I put together What’s new for developers? (October 2026), and I tried something different this month. Instead of walking through every aspect of the project, it focuses on the changes I think matter most if you build on WordPress: custom blocks building their own responsive controls, wp_kses() being rebuilt on the HTML API, stroke-based Core icons, and the automated security review for plugin releases. Everything else is linked at the end. Readers may remember Chris Zarate’s post on moving collaboration to the server from the last edition. Alec Geatches follows it up with a guide to the sync engines for real-time collaboration, comparing yjs-server, DE-RTC, and intent-log on their strengths and weaknesses. In every engine, each change goes through WordPress, which confirms who sent it, checks their permissions, and validates it before merging. You can try all three in the experimental Gutenberg Sync Engines plugin. It needs WordPress 7.0+ and the Presence API plugin, and it bundles its own copy of Gutenberg, so deactivate the Gutenberg plugin first. Feature Notifications has been quiet since version 0.2.0 shipped in April 2023. Jonathan Bossenger is reviving it with a status update and plan for 0.3.0, aiming to ship it with WordPress. That would be the project’s first working MVP: a notifications system that creates, stores, displays, and dismisses notifications. His honest assessment is that the foundations are solid but nothing is wired up end to end yet. He’s posting weekly updates if you want to follow along or help. Benjamin Zekavica published the recap of the WordPress 7.1 “Mary Lou” retrospective, summarizing what contributors would keep, add, and change for future release squads. If you answered the survey, this is where your feedback landed. Plugins, Themes, and Tools for #nocode site builders and owners Sticky headers are one of those things you end up fixing on nearly every block theme site. Jamie Marsland turned his fix into a free plugin, Jamie’s Header Effects. The standout is Chameleon mode: as visitors scroll, the header picks up the background color of the section beneath it and flips its text between light and dark to stay readable. There are also frosted-glass, solid, hide-on-scroll, and transparent overlay styles. It finds your header template part on its own, respects prefers-reduced-motion, and lives under Appearance → Header Effects. Meta Box’s custom models no longer have to sit in isolation. A few weeks after moving model creation into the builder, Lua Nguyen announced the new Custom Model field, which lets you pick one or more items from a custom model the same way the Post field picks posts. MB Relationships also gains a Model object type, so you can connect models to posts, terms, users, or other models in either direction. Think hotel rooms as a post type with bookings attached from a custom model—no IDs stored by hand. On WordPress.com, Ronnie Burt covers what’s new with WordPress Agent: it now designs a custom theme from your answers, hands you off to a simplified AI Editor with Preview and Edit tabs, and can install and manage plugins when you ask. The latest WordPress.com changelog also opens premium themes to every paid plan, starting with Personal. WooCommerce 11.2.1 fixes two regressions: classic checkout on stores that remove address fields with filters, and postcode validation in the Checkout block for Argentina and a few other countries. Theme Development for Full Site Editing and Blocks If you’ve ever had to explain to a client why they should move to a block theme, Simon Cooke has done the work for you. His Human Made guide on how a WordPress block theme is built, and why it matters for enterprise sites walks through each part of a block theme and who owns it, with a side-by-side comparison to classic themes. He’s clear that moving is a project, not a theme swap. The point he lands on: when design rules live in the theme, a page built by someone who joined last week follows the same rules as one the designer built. What if you could point a tool at any static HTML and CSS site and get an editable block theme back, headers and footers included? That’s the Static Site Importer, and Chris Huber of Automattic talks it through with Nathan Wrigley on WP Tavern in episode #238 on making migration to WordPress easier than ever. You’ll hear how it crawls a site, maps HTML elements to blocks, and handles trickier features like WooCommerce, plus how it fits into the broader Data Liberation effort. WooCommerce’s Purple theme has a new home. Luigi Teschio announced that Purple development moves to the WooCommerce monorepo, as the first theme in its new themes/ directory, so contributions and bug reports go there now. One of the stated reasons is that keeping themes next to the blocks they use makes it easier for contributors, and AI coding tools, to see how templates and patterns use WooCommerce blocks. Nothing changes for existing installs, and Purple still releases on its own schedule. For more background, Bob Dunn’s Do the Woo episode on WooCommerce themes in 2026 covers Purple and theme performance. “Keeping up with Gutenberg – Index 2026” A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly.  The previous years are also available: 2020 | 2021 | 2022 | 2023 | 2024 | 2025 Building Blocks and Tools for the Block editor. The new @wordpress/ui package will gradually replace @wordpress/components, so how much of an existing plugin can you move over today? Ryan Welcher found out live by migrating Advanced Query Loop to @wordpress/ui with the Design System MCP. Once your page registers WebMCP tools, those tool definitions are an API, and the consumer is a language model. Pascal Birchler built playwright-webmcp for testing WebMCP tool surfaces, with linting, Playwright matchers, agent evals, and a site audit CLI. He lists the failure modes that make this tricky: vague descriptions the model ignores, schemas the browser quietly rejects, and two tools on the same page with nearly identical names. Extension developers no longer need to duplicate a WooCommerce ability just to expose a few extra fields. Luis Felipe Zaguini opened a call for testing extensible abilities for extension fields, an experimental API in WooCommerce 11.3. Extensions can add fields to product, order, and order item reads and writes, register query filters, and refuse a change with a validator before it saves. It’s off by default, so turn on Extensible abilities under WooCommerce → Settings → Advanced → Features to try it. The gift wrap example in the post is a good place to start. What’s new in Playground? The best way to find out what’s hard about site editing is to watch someone try it. Jamie Marsland built a user testing app for WordPress on Playground and Spacefast to do exactly that. You send a tester a link, and Playground spins up a fresh site in their browser from your existing demo blueprint, with a card of five to seven tasks in the corner. The results page shows how long each task took, who needed the hint, and whether the site actually changed. It’s also an MCP server, and it’ll flag a task that gives away the button name. AI in WordPress Two weeks after the MCP Adapter arrived on WordPress.org as a canonical plugin, the AI team got approval to make MCP a default part of WordPress. Rae Morey reports on the move to make MCP a default part of WordPress, with 7.3 floated as a target. That doesn’t necessarily mean merging the adapter into Core: bundling it, enabling it through existing interfaces, and building specific capabilities into Core are all on the table. It’s also a reversal of the reasoning behind the canonical plugin, and maintainers are asking what changed. The AI contributor summary for October 21 has the meeting’s side of the discussion. Andy Peatling launched WordPress Agent Benchmarks to measure how AI agents handle WordPress, and Rae Morey walks through the first results. Across 193 sites built for requests that suited WordPress, agents chose it zero times, even though they named it as an option about half the time. Using the MCP Adapter alone, they completed no tasks on existing sites, largely because it doesn’t yet bundle the abilities for common operations. Brian Coords asks what WordPress would have to change in helping agents choose WordPress, drawing on a WP Minute panel with Andy. Is the MCP Adapter safe? Brad Williams of WebDevStudios calls it a door: “You decide which rooms it opens into.” He explains why production use of the MCP Adapter is a governance decision, not a plugin decision. An agent gets whatever abilities are exposed, using the permissions of the user it connects as, and every plugin you install can add more. His advice is to write the agent’s job description before you hand over the keys. If you connect an AI client to WooCommerce, this one needs action before you upgrade. Darren Ethier explains that WooCommerce 11.3 removes its deprecated MCP endpoint. Requests to /wp-json/woocommerce/mcp will return a 410. Install the MCP Adapter, create an application password for a user with only the capabilities the client needs, and point the client at the adapter’s default server. Extensions that hooked into the old endpoint’s filters should check the post’s full list of what’s been removed. WPShout’s guide on how to connect Claude to WordPress opens with the question most guides skip: where your site is hosted decides which route you take. WordPress.com, Jetpack, and other self-hosted sites each get their own path, and the walkthrough uses a free MCP plugin with a least-privilege grant. It’s also candid about a gap: the WordPress MCP Adapter has no OAuth server of its own, so claude.ai’s sign-in can’t connect to it directly yet. Post revisions spent years bloating databases. Human Made thinks they’re about to become valuable. In WordPress revisions: agentic gold?, Noel argues that every revision records what changed, who changed it, and when, which makes them a log of how your team really works. Mine them for repeated changes and you’ve found the workflows an agent could take over. The post includes a prompt you can run, on a copy of your database and never on production. Need a plugin .zip from Gutenberg’s master branch?Gutenberg Times provides daily build for testing and review. Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience. Questions? Suggestions? Ideas? Don’t hesitate to send them via email or send me a message on WordPress Slack or Twitter @bph. For questions to be answered on the Gutenberg Changelog, send them to changelog@gutenbergtimes.com

As technology advances, prioritizing speed and convenience can undermine critical engagement and reflection. While automating tasks may enhance efficiency, it risks diminishing the unique value individuals bring to understanding and decision-making.

Faster security scans reveal new software issues yet patching and project upkeep require committed maintainers and company contributions.

Connect Claude to WordPress with a free plugin: add your site as a custom connector, approve access, run a first task, and fix it when it won’t connect.