There are 7 security fixes and 4 bug fixes. Because it is a security release it is recommended to update sites immediately.

Some things that jumped out at me were that a large number of site owners don’t have a response plan and 17% discover a security problem because a notice on a search engine.

An update on automatic security reviews for plugins on the WP plugin directory.

The WordPress security team received 773 reports of security vulnerabilities in August, up from around 20-30 a month last year. The team starts to put some new limitations on what they will accepts via the HackerOne disclosure program.

If I was reading this correctly, the payload is planted using a ping-back. I wonder how many of these types of holes there are?

It looks like more vulnerabilities were found after the team patched Pods earlier in the mont

Konstantin Ryabitsev from the Linux Kernel team reports on their fight with AI bots. The current situation doesn’t seem sustainable.

Surprisingly there is nothing on the plugin page on WP org about Rank Math creating unauthorized admin access. I would expect that Rank Math would be suspended, at least until fixed, if not for longer. Roger Montti’s report helps to get the word out about this bad behavior.

These are both security releases to patch access control issues in the Design Library endpoints which were reachable without authentication.