Two security stories from last week got worse. The Brotli server flaw can run code, and attacks on the WordPress 7.1.4 flaw passed 240,000. WordPress 7.2 also moved closer to release, with AI tools growing alongside it.

Security: Two Flaws, Both More Serious Than First Reported

On November 2, Wordfence said it reproduced remote code execution through the Brotli flaw. Remote code execution means an attacker runs commands on your server. We first covered it as a crash risk on October 30. Our full write-up has the fix.

Brotli is a compression library on your server, so WordPress updates will not fix it. Ask your host to confirm it patched CVE-2026-111497. If you do not use pingbacks, block xmlrpc.php. The original report explains how the attack reaches WordPress.

The core upgrade flaw fixed in 7.1.4 is now on a U.S. government list of exploited bugs. Wordfence says its firewall has blocked more than 240,000 attempts. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on November 2. Our report has the details. Confirm under Dashboard, then Updates, that you run 7.1.4. We covered the release itself and the first attack attempts earlier.

AI: More Agent Controls, and a Security Team That Hunts

AI plugin 1.5.0 arrived with six new experiments, including text to speech and a new Tools, then MCP Access screen. That screen lets you pick which actions an AI agent may run on your site. It also fixes two security advisories, so update. Read our full breakdown, and see the MCP Adapter it builds on.

Separately, the WordPress Security Team said on October 29 that it is building AI tools to find core bugs before anyone reports them. Automattic’s Head of Security, Rudy Faile, wrote that the team cut its backlog of unreviewed reports from 359 to double digits. The tooling is not live yet, and the team has not said when it will launch.

That fits the pattern behind seven core security releases since July. A flood of AI-assisted reports pushed the team to build its Core Security Initiative.

WordPress Core: 7.2 Takes Shape

WordPress 7.2 Beta 4 shipped on Tuesday, November 3. The Updates screen now lists translation updates with checkboxes, so you choose which to install. It also fixes a Visual Revisions bug where restoring an older post version could wipe unrelated custom field values. If you test betas, use a staging site.

Release 7.2 will also add a /random/ URL that sends visitors to a random published post. It is on by default, so check whether you want it.

A design for a notification center is also in discussion. It would replace cluttered admin notices with a bell icon. It is a proposal, not something shipping soon.

Block Editor and Playground: Testing Gets Easier

Gutenberg 24.3 lets you format text across several blocks at once. It also adds emoji reactions to notes and clearer messages when a save fails. Test it on staging before updating production.

WordPress Playground can now copy your live site into your browser. You need the Reprint plugin and admin access. Your live site is not changed, which makes it a safe place to try updates.

End of article