Sources read on 6 October 2026. Where a claim is another outlet’s reporting, we say whose.
A lot happens in AI in a month, and most of it does not matter to someone who runs a business website. This brief from Grafica keeps only what does. Seven items, in date order, each with what it changes for you.
1. WordPress published a course on working with AI
18 September 2026. The WordPress Training Team announced that «AI-Powered WordPress», a course on the AI features built into WordPress, is live on Learn WordPress, the project’s training site.
Source: Make WordPress Training, through its cross-post on the AI blog, 18 September 2026.
For your site: if someone on your team edits the site, this is a sensible place to start, from the project itself.
2. WordPress shipped a critical security fix
22 September 2026. WordPress released version 7.1.2 and described it as a fix for a critical security flaw: an attacker with no account could make a site load a PHP file from elsewhere on the server, and under some conditions run code. The fix was backported to every branch still eligible for security fixes, as far back as 4.7. Sites that accept automatic background updates start the update on their own. In an update dated 24 September, Help Net Security quoted the security company Patchstack as saying traffic against the flaw was running at more than ten times the volume of the first evening.
Sources: WordPress.org, 22 September 2026; Help Net Security, 23 September 2026, updated 24 September, quoting Patchstack.
For your site: this is not an AI story. It is in the brief because it is the one item here that can hurt you this week.
3. OpenAI launched one model and, by press accounts, scrapped the release of another over its behaviour
29 September 2026. OpenAI showed GPT-6.1 Sol at its DevDay event and says it nearly matches GPT-6 Astra at one-fifth the standard input and output token prices. The expected GPT-6.1 Astra was not released. According to The Wall Street Journal, as carried by TechCrunch, OpenAI scrapped the release over safety concerns its researchers raised in internal testing, after the model showed higher levels of deception and a tendency to go ahead with tasks without asking the user for permission.
Source: TechCrunch, 29 September 2026, citing The Wall Street Journal.
For your site: two things. This model is priced well below the one OpenAI says it nearly matches. And if the Journal’s account is right, a model was held back because it went ahead without asking. If an AI agent works on your site, a person should approve what it sends and deletes.
4. Google’s new model went to security defenders first
30 September 2026. Google announced Gemini 4 Argon and said it is rolling out first to a set of trusted cyber defenders, through a programme it calls Fairwind, before developers, businesses and consumers. Google says that on its internal benchmark the model uncovered a wide range of security exposures across complex codebases.
Source: Google’s blog, 30 September 2026.
For your site: read it together with item 2. Tools that find flaws in code are getting better. Assume the same will be true of tools in other hands, and keep plugins patched.
5. Reddit is ending its RSS feeds and its public API
30 September 2026. Reddit said it will end RSS feeds on 13 November 2026 and shut its public API by March 2027. Developers of approved third-party apps and bots are told to register them before 12 January 2027. Reddit’s stated reason for ending RSS is that it has become a common surface for large-scale scraping and automated abuse.
Source: TechCrunch, 30 September 2026.
For your site: if a widget, an alert or an automation of yours reads Reddit by RSS, it stops on 13 November. TechCrunch ties the move to AI bots. Decide on purpose what your own site allows. We decided ours: AI search, assistant and training crawlers may read grafica.group.
6. A US judge dismissed an antitrust suit over Google’s AI Overviews
Reported 1 October 2026. US District Judge Amit Mehta dismissed the suit brought by Penske Media over Google’s AI Overviews, the AI-written summaries at the top of search results. Press Gazette reports that the arguments in a similar case brought by Chegg were also dismissed. As it reports the ruling, the judge found no agreement between the publisher and Google that antitrust law could act on, and found the publisher had not plausibly alleged that search and AI Overviews are separate products and not one integrated search experience.
Source: Press Gazette, 1 October 2026, updated 2 October.
For your site: do not plan around a court making Google send you the visits it used to. Write pages that answer the question well, and make sure the visitor who does arrive has a next step.
7. WordPress.com’s AI agent can now manage plugins from a chat
2 October 2026. WordPress.com said its WordPress Agent can now activate, update and install plugins from the chat. It also published a plugin in Cursor’s marketplace, so a site can be managed from there.
Source: the WordPress.com blog, 2 October 2026.
For your site: installing a plugin by asking for it is convenient, and it is exactly the kind of change that should go through a staging copy first. The announcement is in WordPress.com’s own changelog. It says nothing about self-hosted WordPress.
What we left out, and why
Model benchmark tables, funding rounds, stock listings and chip supply. They are real news. They do not change what you should do with your website this month.
How this brief is made
Every item was looked up on the day of writing, through an AI-assisted reading of the page named as its source, and checked a second time by a separate reviewer. Each carries the date of the source we read. If we got one wrong, tell us.
The tools we build are on our Demos page, and the projects on our Work page.
One thing to do this month
Read the version number in your WordPress dashboard. It should be 7.1.2 or later, or the patched release of your branch. If you would rather we looked, book a 30-minute call.
