AdultZone

Archives

Dennis Snell: Radical explorations in agentic development

In mid-April 2026 my employer started a project called “Radical Speed Month” to step away from our existing structures and processes, make space for people to dive more deeply into AI tooling, and try to build new or sleeping ideas. My participation in this experiment ran until late September and I stacked up a lot of explorations without having written about them or about the process. In this post I’d like to highlight some of the results of this time and share some learnings. Selected lessons Massive agentic deployment demands heavy storage and generic compute capacity — inference is not the only bottleneck. This is necessary to support massively parallel checkouts of code, benchmarking, analysis of other software and data, running hierarchies of thousands of test workers and headless browsers, generating and analyzing image and video artifacts, creating indexes, and more. Instructing an agent to “find the five hidden defects” is more effective at finding real issues than asking if there are any hidden defects. They may return false claims, but they try to answer the questions they are prompted — it’s not that different than the comparison between asking someone what in their day brought them a smile, or what was difficult for them, rather than asking “how was your day?” Agents with web searching capabilities are powerful knowledge-retrieval and aggregation tools. Reports they generate to aid in developing code can be more effective than asking the agents to generate the code directly. Models today are incredibly powerful, but guiding human insight is also powerful. Autonomous agentic activity demonstrated a tendency to produce more evidence of accomplished work than actual accomplished work. In a strange way this might reflect the training dataset: corporations must also guard against the dangers of overly-burdensome paperwork. Projects All of the projects here were almost entirely built by AI agents, but with my guidance and supervision. Therefore, credit for each of them does not rest entirely with me. However, for the sake of brevity I will omit mentioning in each one that AI tooling was the actual producer. Each project below is assigned a truly unscientific evaluation: The project succeeded with clear value. The project completed its goals, but the value is unclear. The hard work has completed, but I need to close the loop and deploy it. The idea is sound but not ready; it needs more development. The project failed to bear fruit for any reason. My personal favorites: Fix bugs in proprietary hardware drivers Gather empirical evidence to guide development decisions Stream real-world HTML from Common Crawl Provide deep insight into PHP script execution Rapidly prototype a comprehensive collaborative editing environment for WordPress Tools Because I expected a short availability for the enhanced AI access, I prioritized building, early on, tools whose value would outlast the project. Generally I prefer working in offline or local environments, so I built archivers for several services which are only available when connected to the Internet. While MCP servers were very popular at this time, I have always been unhappy with the load centralization and amplification they create. The same is true for any online resource against which agents perform searches. My intuition is that it’s more considerate to those services to make one batched update, to download all new data since the last sync, than it is to make repeated queries which might overwhelm their servers and fetch the same resources over and over. Being offline and local, the archivers are extremely fast and operate in the terminal where I prefer to interact. GitHub archive Finding GitHub’s search functionality lacking, and wishing for a chronological stream of my activity, I built github-archiver so I could have the tools and performance I wanted. This initially supported searching through PRs, issues, and comments, as well as rendering my own activity in a reverse-chronological view. I eventually added two additional views for replies: people I replied to, and people who had replied to me. This gives me great awareness of my recent conversations and has helped me to avoid losing conversations. Sometimes I struggle to find a PR that I meant to follow-up on, but it disappears from my GitHub notifications and I can’t remember the exact wording that will turn it up in a search result. I even tend to forget in which code repository it was left, so my tool aggregates activity across all archived repositories. The basic design is a compressed HTTP cache of the GitHub API. When fetching or updating, it respects rate limits and leans on HTTP headers to avoid wasted transfers. After some work with banking APIs several years ago, I found that storing raw HTTP responses proved more flexible than parsing into a custom internal data type, as it lets me rewrite logic in the app later without having to re-download the entire archive. This came in handy several times as I expanded the search index and added more functionality. The tool renders GitHub content as richly-formatted and highlighted text in a console unless running outside of an interactive TTY. It renders Markdown and HTML content into this rich text format and lays out meta elements in a meaningful way. Its speed, zero-network dependence, and minimized output make it a good fit for agents that would otherwise be hammering GitHub’s API, waiting, and wasting tokens on irrelevant content. Trac archive Just like the github-archiver, I built a trac-archive for WordPress’ Trac system. It is feature-similar to the GitHub archiver, but provides an additional perk: because bots relay messages from GitHub back into Trac, issues often have two markup formats in use simultaneously. My trac-archive first parses its content according to Trac’s own system, but then it additionally parses Markdown where it finds it. It shares much of the rendering logic with the github-archiver and provides a clearer experience than the web view due to the additional parsing, syntax highlighting, and ability to exclude bot traffic from the results. Review the evolution of a series of commits over time git-sequence-patch

Matt: Pushing Standards

We get a lot of flak at WordPress.org for supporting older PHP versions, but an area we’ve always pushed the frontier is in Web Standards, getting websites and browsers evolving together to make the web richer. Ever since I caught the religion from Zeldman, promoting more functionality in the browser has been a life mission. It’s a little nerdy, but we wanted to do client-side media processing (use all that amazing Apple and Google silicon instead of burdening the poor servers) so we used something amazing Google created called Document Isolation Policy. When WordPress 7.1 “Mary Lou” shipped these features only worked in Chromium-based browsers and Mozilla and Webkit/Apple weren’t keen to support it, but since then Mozilla has expressed support and WebKit has withdrawn their initial concerns. WordPresser Adam Silverstein has been driving much of this work and opened a WICG issue to help move the standard forward and formally requested that WebKit add support. Hat tip: Anne McCarthy for helping with this post. (If you want to see other crazy stuff we’re doing in browsers, check out WordPress Playground, I think it’s actually the perfect web development environment for agents, which can then publish to Spacefast.)

WordCamp Central: WordCamp Jinja 2026 Recap: Three Tracks, Two Days and Creative Currents on the Nile

On 19th and 20th September 2026, the WordPress community gathered at Civil Service College Uganda, a venue close to River Nile, for the fifth edition of WordCamp Jinja. The event brought together more than 300 diverse participants across 2 days and 3 parallel tracks of sessions full of learning, collaboration and connection. In a city known for its flowing waters, creativity and ideas flowed too, as participants shared their experiences, explored new possibilities with WordPress and built relationships that would carry beyond the weekend. Our theme, “Embrace Creative Currents on the Nile: Where Inclusivity Fuels Creativity,” reflected the mix of people and ideas in the room. Students sat alongside developers, designers, writers, educators, entrepreneurs and experienced WordPress contributors. Across three parallel tracks, everyone could find a way to learn, share or build. Students and Creatives at the heart of WordCamp Jinja Nearly half of this year’s participants were students. Their presence was felt throughout the event, from the speaker sessions to the labs and hackathon tables. We had students from primary schools, secondary schools and universities joining us for this year’s WordCamp. Some came to explore WordPress for the first time. Others arrived with projects, questions and skills they wanted to develop. Sharing the same spaces with people already working in technology and creative fields gave them an opportunity to learn directly from practitioners and see where their own interests might lead. One student in attendance found a creative way to remember his experience. Fascinated by the WordPress ecosystem, its generosity and inclusivity, he drew all the sponsor logos by hand so he could remember them after the event. His drawings became a personal record of the community he had encountered at WordCamp Jinja, a small but memorable expression of the curiosity WordCamp Jinja inspired. Bringing young people into the community has been a continuing part of WordCamp Jinja’s work. Last year’s edition at Jinja Senior Secondary School brought the event closer to students; this year, their participation remained central even at a different venue. We hope the relationships formed over these two days continue at Jinja WordPress Meetups and in the projects students choose to pursue next. Event highlights Diverse Speaker Sessions Our speakers brought different backgrounds and experiences to the stage. Sessions opened up conversations about WordPress and the wider web, including how people use technology to create, teach, solve problems and build livelihoods. The value of these talks was in the experiences behind them. Speakers shared what they had learned through their own work, answered questions and gave attendees ideas to take back to their studies, organisations and businesses. Thank you to everyone who prepared a session and made the journey to Jinja to share it with us. Charity Website Hackathon and Contributor Sessions The Charity Website Hackathon returned as one of WordCamp Jinja’s most practical activities. Participants and facilitators worked together on WordPress projects for organisations seeking to establish or improve their online presence. The teams had to think about real needs: what information a visitor should find, how to organise it and how the organisation could keep its site useful after the event. For newer participants, this was a chance to learn by working through a real project with support close at hand. For experienced developers and designers, it was a chance to mentor others and put their skills to work for the wider community. The work begun at the hackathon can continue beyond the conference as teams and organisations develop their websites further. Contributor activities connected that local work to the wider WordPress project. Attendees explored the idea that contributing to open source goes beyond writing code: people can help through photography, translation, testing, documentation, training and community work. There were a lot of new contributors who were taken through the contribution journey by table leads. We hope that for those that took their first steps, WordCamp Jinja will be the beginning of a longer contribution journey. Hands-on Labs The Hands-on Labs offered a different pace from the speaker sessions. Instead of only listening, participants could practically follow a facilitator on state of the art computers, try something themselves and ask for help when they needed it. That kind of guided practice matters, especially for people who are new to a tool or trying to turn an idea into something they can build. Thank you to the facilitators who prepared the activities and worked directly with participants, and to the volunteers who helped make the sessions run. Memorable moments, connections and networking Some of the weekend’s most useful moments happened away from the front of a room. Over lunch, in the corridors and between activities, attendees met people from other communities, exchanged ideas and caught up with friends they had met at earlier WordPress events. For a student attending for the first time, a conversation with a developer or designer can make a possible career feel closer. For returning community members, it was a chance to meet new collaborators and hear perspectives they might otherwise miss. Those connections are part of what keeps WordCamp Jinja going after the closing session. Celebrating at the Source of the Nile The celebration continued at Source of the Nile for our after-party, where attendees, volunteers, speakers, facilitators, sponsors and organisers were welcomed to the Source of the Nile. Unbeknownst to them, there was a surprise awaiting: an after party aboard a double-decker boat. The boat ride took them on a tour of Lake Victoria and finally landed at the actual source of the Nile itself, where they learned about its history before taking time for photos together. The Nile has been part of WordCamp Jinja’s identity across previous editions. This year, gathering there brought our theme back into focus: people with different skills and experiences had come together, learned from one another and added something to the community. The people who made it possible WordCamp Jinja is built by volunteers. Long before the doors opened, the organising team was working on the venue, programme, speakers, communications, sponsorships,

bbPress: bbPress 2.6.20 is out!

bbPress 2.6.20 is a security and maintenance release. Everyone running bbPress should update. This release strengthens topic and reply password validation and keeps bbPress post shortcodes literal in ordinary WordPress content loops. It also adds a site-wide Forum Status setting with Open, Closed, and Frozen modes. Existing sites remain Open unless that setting is changed. The maintenance work improves BuddyPress profile actions, group topic routes, activity visibility, and group-forum access. It also restores compatibility for subscription links in third-party theme packages, preserves moderation forms after validation errors, and includes fixes for notifications, converters, widgets, profiles, topic and reply administration, and restricted-content visibility. bbPress 2.6.20 still requires WordPress 6.0 or newer and PHP 7.2 or newer, and is tested through WordPress 7.1. The database version remains 264, so no database upgrade is required. The 2.6.20 upgrade notes cover compatibility details. These changes are also in the 2.7 development branch, which remains 2.7.0-alpha-4. Thank you to ahillmortons, alejandroescobar89, bor0, bradleyt, chefranov, dd32, deborah86, Dermes, diegootgs, dilip2615, fraph24, hardel, imath, immeet94, iworks, jgasba, josephscott, konnektiv, lmstearn, mehrazmorshed, michael8888, mike80222, obenland, Palagrin, peopleinside, r-a-y, robin-w, SirLouen, tobifjellner, wpturk, and zaerl for reports, patches, testing, and review. Download bbPress 2.6.20 from WordPress.org, or update from your WordPress dashboard.

Open Channels FM: The Hidden Dependency Problem in Open Source Infrastructure

When we think about what keeps the Internet humming, most of us imagine massive data centers and super-fast connections. Fewer people realize that our everyday digital experiences often depend on the efforts of a very small group of individuals. Recent analysis revealed that in many essential open source projects, just one or two people are […]

#237 – Robert Abela on WordPress Security and the Battle Against AI Threats

Transcript [00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the state of WordPress security in 2026, and the battle against AI threats. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there. So on the podcast today we have Robert Abela. Robert has been working in IT security for 25 years, ranging from antivirus software to web security scanners, and for the past decade has been running Melapress. A company focused on WordPress security plugins, particularly around user visibility, authentication, activity logs, and 2FA. Robert is here to talk about the 2026 WordPress security survey. This is an annual project now in its fourth, or fifth, year gathering data from a wide range of WordPress professionals across agencies, enterprise teams, freelancers, and product owners. The conversation today is focused on the biggest security challenges and trends facing WordPress users in 2026. We start off with some sobering stats. Over 67% of survey respondents reported experiencing at least one security incident in the past year, and concerns about WordPress security remain high, especially among less technical users. We chat about the disconnect between awareness of security threats and actually taking steps to mitigate them, such as breach recovery plans and team training. The discussion also explored the different types of risks that worry site owners. Site downtime, defacement, reputational damage, data loss, and even legal compliance issues. How the shakeout depends on the type of site, whether it’s e-commerce membership, a news outlet, or a simple brochure site. We also talk about the tendency for even experienced WordPress users to take a reactive approach, only addressing vulnerabilities after something has gone wrong. Towards the end of the episode, we discuss the rising impact of a AI on security, the explosion of AI facilitated vulnerabilities, and the shifting landscape of risk and response. There’s a healthy dose of reality, some optimism about the tools and best practises available, and plenty of good advice, especially for smaller teams and freelancers who may not have access to enterprise level resources. If you care about keeping your WordPress sites secure, or want to understand where the community’s biggest concerns and opportunities are in 2026, this episode is for you. If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast where you’ll find all the other episodes as well. And so without further delay, I bring you Robert Abela. I am joined on the podcast by Robert Abela. Hello, Robert. [00:03:48] Robert Abela: Hello Nathan. Thanks for having me. [00:03:50] Nathan Wrigley: You’re very welcome. Nice to have you with us. We’re going to chat today about internet security, but we’re going to be looking back over the past year, so the year 2026. Robert, can tell us a little bit about the company he founded, works for, and so on. It’s called Melapress, you can find out about that in just a moment. But I would like to draw your attention to something which is going to really be the fulcrum of what we talk about. It is their 2026 WordPress Security Survey. Now, the easiest way to get that is probably to go to wptavern.com, search for the episode with Robert in it, and I will make sure it is linked in the show notes there. But it might be a good idea to read it, because in about 10 minutes, you’re going to be able to capture absolutely everything that we’re talking about today, and you’ll get all of the data and, what have you. But that’s going to be the point of this episode, summarizing what happened in the security space in WordPress in 2026. Robert, I guess there are a few areas in the WordPress space where it’s pretty important to know that we know, that you know, what you’re talking about when it comes to security, because we don’t want to have a lot of hot air from somebody who’s not experienced. So it’s an opportunity for you really to give us your bio and tell us a little bit about what you’ve been doing in the WordPress space, particularly around security, the companies you’ve worked for, the things that you’ve founded and so on. So over to you, Robert. [00:05:07] Robert Abela: Thanks. I’ve been working in IT security for twenty-five years. I’ve always worked for software companies, software startups which worked in security industry. We used to do antivirus software, web security scanners, et cetera. I’ve had different positions. I started as systems engineer, QA, product management, project management, almost any field. Anyway, and the last ten years I founded Melapress, and it’s a WordPress plugin business, and basically we develop a number of security plugins for WordPress. The security we do, we don’t do the typical firewall malware, et cetera, like the other, brands. We mostly focus on user visibility and authentication. So basically we have an activity logs plugin, and we also have a plugin for 2FA, passkeys et cetera. So we are focusing much more, on what happens post login once someone logs into WordPress, rather than the whole hardening and protection. [00:05:56] Nathan Wrigley: Thank you for that. So anybody that’s interested, anything that we mention today, including the URLs of the companies that Robert has just mentioned, so Melapress, you’ll be able to find those in the show notes as

Matt: RIP Eric Binnion

For the next 30 days, a few billion of you will get an extra header in honor of Eric Binnion. The code in Nginx to do this is poetic: add_header X-Remembering “Eric Binnion <https://friendsofericbinnion.wordpress.com/>” always; Our design team will make that less AI and more humane in the coming days. Automattic.com will have a mourning band for 30 days. Eric was the 21st recipient of the Distinguished Janitor Award, Automattic’s highest honor, and in our hangs the last few months we’ve been talking about how to redefine and evolve it, which will happen internally at Automattic. One of the ideas was for the award to come with a physical memento, an etched tungsten cube. I don’t have many words so I’ll share something I wrote to Eric a few months ago when I gave him my cube when he was going through chemo. Two Totems To Take With You The first is a tungsten cube I keep on my desk. Its weight will surprise you, but tungsten is singular in having the highest melting point of any metal. That represents one of the things I admire most about you. Tungsten has an atomic number of 74, its symbol is W, and it’s also known as wolfram. My next post I’ve had in drafts for a while so please try to imagine me happy and promotional when reading it, but otherwise, I’m wrecked. Just going to soldier through because that’s what Eric always did.