A critical Apache flaw landed on Thursday, and only your host can fix it. WooCommerce changed how it ships security updates. WordPress 7.2 got a flagship theme, plus pushback on two of its new features.

Security: Apache and WooPayments

Apache released version 2.4.71 on November 11 to fix a critical flaw in its HTTP/2 module. The flaw can let an attacker run code on the server. It is not a WordPress bug, so nothing in your dashboard will fix it. Our full write-up explains who is exposed and what to ask your host.

This is the third server-level flaw in three weeks. We covered the Brotli compression flaw and the critical PHP release earlier. The lesson repeats: your host’s patching speed matters as much as your plugin updates.

WooCommerce also released a security fix for WooPayments across every version line, which we covered on Saturday. Open Plugins, Installed Plugins, and confirm your version matches a fixed release.

WooCommerce: Required Updates and a PHP Deadline

On Tuesday, WooCommerce explained why security updates have come so fast this year. It says reports about its products rose roughly nine times in a year, as AI tools made bugs easier to find.

The change that matters most: starting with WooCommerce 11.2, security releases for Marketplace extensions can be marked required. Connected stores with an active subscription install them on the next update check, even with auto-updates off.

PHP is changing too. WooCommerce 11.6, due in February 2027, requires PHP 8.1 or newer. Our full breakdown has the dates and a checklist.

WordPress Core: 7.2 Under Scrutiny

WordPress 7.2 Beta 5 is the last scheduled beta, announced on Tuesday. It resolves all known issues with PHP 8.6, which is due on November 19. It also adds an email alert when someone creates an application password. Those are the passwords that let outside apps connect to your site. Release Candidate 1 is due November 17, and the final release on December 8.

Two 7.2 features drew pushback this week.

The Secrets API stores API keys encrypted. On Thursday, Human Made’s Ryan McCue called for it to be pulled from 7.2 in a comment on the developer note. He argued that secrets should be set outside the application, not managed by it. Developer Eric Mann replied that most sites have no other place to keep credentials, and said he would fix a bug McCue found in the AI plugin. The API remains in the release for now.

The /random/ URL also met resistance. It is on by default, and agencies with many client sites say they must now switch it off. Critics raised hidden content surfacing and slow queries on large sites. Matt Mullenweg has since agreed it should not use the page URL structure, so expect changes before release.

Block Editor: A Flagship Theme and Text Shadows

On Friday, the WordPress project introduced Mētis as its flagship theme. It was first the team’s idea for the next default theme. The more minimal Ipsum took that role instead. Designer Henrique Iamarino says a default must work for every site, while a flagship can show what the editor can do.

Mētis ships with six starter sites, 50 section patterns, six style variations, and nine open-source type families. A demo site is available now, and community feedback will feed a formal review.

WordPress 7.2 also adds text shadow controls to Paragraph and Heading blocks. You pick from presets in the Typography panel. Test both on a staging site first.

End of article