Trending Tech Brief #3: WordPress 7.1.4 Security Update, Ads in Google AI Mode, and ChatGPT Gets iCloud (Week of October 26, 2026)

1. WordPress 7.1.4 security release: should you update now?

On October 28, WordPress.org released WordPress 7.1.4 and recommends updating “immediately.” It fixes a weakness in the update process that could lead to remote code execution during the upgrade window, plus a long list of stored cross-site scripting (XSS) bugs in blocks, the Customizer and the Interactivity API. Sites with automatic background updates should start updating on their own. The fixes were also backported to older branches, though WordPress says only the latest version is actively supported. The next major release, 7.2, is planned for December 8.

For a plain-English rundown of each fix, see Patchstack’s write-up and the official 7.1.4 release notes.

What this means for you: Don’t assume auto-updates ran. Open Dashboard > Updates and confirm it says 7.1.4. If it doesn’t, back up and click Update Now.

2. Is the PHP “php2shell” flaw being exploited? CISA says yes

Last week’s brief covered two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. On October 26, CISA updated its alert to say both are now in its Known Exploited Vulnerabilities catalog, meaning attacks have been seen. CISA says the flaws affect PHP setups serving web requests, including PHP-FPM and LiteSpeed, and that the fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Systems still on PHP 8.1 or earlier get no fix, and CISA advises taking them offline until they are updated.

What this means for you: This is now urgent, not routine. Check your PHP version under Tools > Site Health > Info > Server, and confirm with your host that the patched build is installed. If you manage your own server, patch it today.

3. Ads in Google AI Mode: 10 more countries, and ads in follow-up answers

On October 28, Google announced that ads in AI Mode, the chat-style part of Google Search, now run in Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines and Singapore. Brazil, Mexico and the UK are planned for later this quarter. In the US, new “multiturn” ads can appear in answers to follow-up questions. All of them are labeled “Sponsored.” Google says click-through rates are “similar” for sponsored and organic product listings in AI Mode, but it did not publish the numbers.

The news came with Alphabet’s earnings. TechCrunch reports that Search revenue grew 12% year over year, down from 17% the quarter before.

What this means for you: More paid placements inside AI answers means more competition for the clicks that reach blogs. Watch your Search Console clicks and impressions month to month. Pages with first-hand testing and clear answers are still what can earn a citation in AI results.

4. How to connect iCloud Mail and Calendar to ChatGPT, and how to disconnect safely

On October 27, OpenAI added iCloud Mail and iCloud Calendar plugins to ChatGPT, available on all plans on web, desktop and iOS (MacRumors). Mail can search and read messages, manage drafts, send email and look up contacts. Calendar can read, schedule and update events. You add each one separately under Settings > Plugins, using an Apple app-specific password, not your regular Apple password (OpenAI Help Center).

One detail is easy to miss: disconnecting iCloud in ChatGPT does not revoke the app-specific password at Apple. You have to revoke it yourself in your Apple Account under App-Specific Passwords.

What this means for you: If you run your business from an iCloud address, this can save time on scheduling and inbox triage. Create a separate app-specific password for each service so you can revoke one without breaking the other, and keep approval prompts on before anything is sent.

5. Does the new AI assistant in Pages, Keynote and Numbers cost extra?

On October 27, Apple announced a beta assistant for Keynote, Pages and Numbers, built on Apple models and OpenAI. It designs and animates slides, drafts and restructures documents, and suggests charts and tables in spreadsheets. It is part of Apple Creator Studio, arrives as a free update for existing subscribers in November, and requires an Apple Intelligence-capable device on iOS 27, iPadOS 27 or macOS 27, in US English only.

Apple also added Model Context Protocol (MCP) support on macOS 27, which lets outside AI agents read, edit and run actions inside the three apps. The Verge reports the apps themselves stay free; TokenPost reports Creator Studio costs $12.99 a month for new US subscribers.

What this means for you: If you build slide decks, workbooks or printables on a Mac, you may not need a separate design tool for first drafts. Apple has not said which AI apps work over MCP or whether MCP needs the subscription, so wait for the November update before paying for anything.

6. Has TPT published its AI policy yet? Not as of October 28

Three weeks after TPT’s October 8 town hall, a seller-education site that tracks the story says TPT still has not published a written AI policy, enforcement date or definition of “AI-assisted” (Graphene, updated October 28). The direction is unchanged: TPT asked sellers not to use generative AI in resource files, covers, thumbnails, previews or descriptions. Watch the TPT Seller Blog for the official wording.

What this means for you: Keep working through covers and descriptions first, and keep dated drafts of your own work. Our running summary: What TPT sellers know so far.

Questions people are asking this week

“Did your sites actually update, or do you just have auto-updates turned on?” (asked on r/Wordpress about an earlier release, and it applies again now). Check, don’t assume. Dashboard > Updates shows your installed version. Hosts and settings in wp-config.php can delay or block automatic updates.

“Why isn’t there an iCloud plugin?” (asked on r/ChatGPTcomplaints). There is now, for Mail and Calendar. Contacts lookup is included read-only, but standalone Contacts and Reminders plugins are not part of this launch, according to OpenAI’s Help Center.

“Are Pages, Numbers and Keynote subscription based now?” (asked on r/MacOS). No. The apps remain free for creating and editing. The AI assistant and other intelligence features are for Apple Creator Studio subscribers.

“What does AI Mode mean for my traffic?” (a recurring thread, for example on r/GEOMaestros). Nobody outside Google has hard numbers yet, and Google’s own click-through claim covers product listings only. Your Search Console data is the best guide for your own site.

Also noted

• Google DeepMind announced Gemini 4 Carbon on October 28. For now it is limited to selected cyber defenders through its Fairwind program, so most people can’t use it yet.
• Google DeepMind also previewed Genie 4, a real-time interactive world model with native audio. It is limited to trusted testers, with Google AI Ultra access planned.
• Oracle and OpenAI announced on October 27 that Oracle apps are coming to ChatGPT, plus a small-business bundle of ChatGPT Business, Codex and Oracle cloud credits.

Your action list for this week

Numbers in this issue

What we’re watching next week

• Whether WordPress 7.1.4 backports finish shipping for older branches.
• Reports of PHP attacks on unpatched shared hosting.
• Which AI apps Apple confirms for MCP in Pages, Keynote and Numbers.
• TPT’s written AI policy.

Related deep dives

• How to audit WordPress AI plugins for security
• TPT’s AI stance: what we know so far
• AI disclosure rules compared: KDP, Etsy, TPT and Gumroad
• Trending Tech Brief #2
• Trending Tech Brief #1

How solid is each item?

We label sources honestly: primary pages where we could read them, press reports or summaries where we couldn’t. If something changes, we’ll correct it in next week’s issue.