On Wednesday we told you a WordPress patch had been attacked within five hours. By Friday the number that mattered had changed. More than 350,000 sites are still running the unpatched version, and the attackers have stopped probing and started planting web shells. That is the week in one story.
Here is the rest of it, with what has happened to each story since it broke. That hindsight is the part a daily brief cannot give you at the time.
The three biggest changes
Your WordPress site had a five hour head start and 350,000 sites never took it
WordPress shipped a fix on Monday 22 September for CVE-2026-87902, a flaw rated 9.2 out of 10 that lets an attacker with no login read files off your server and run code on it. Patchstack logged the first exploitation attempt the same morning at 11:49 UTC.
Since then it has got worse, not better. Attack traffic climbed more than tenfold the following day. Previdian honeypots recorded 68 separate exploitation attempts from 23 September. Shadowserver counted more than 350,000 sites still unpatched by the end of the week, and researchers are now finding web shells, which are the small scripts an attacker leaves behind so they can come back after you patch.
Why this matters for your business: Patching is not a job for next month’s maintenance window any more. Check your core version today, and if it is below 7.1.2, update it now. Then look for files you do not recognise in your wp-content and wp-includes folders, because a patch does not remove a web shell that is already sitting there. Turn on automatic updates for core while you are in there. The argument against them was that an update might break something. The argument for them is now five hours.
Facebook will let a free business page post two links a month
Meta began showing some page managers a notice capping them at two link posts a month unless they pay for Meta One. We covered that cap on Monday.
Since then it has spread rather than been walked back. Social Media Today, Social Media Examiner and a run of smaller outlets carried it through the week, and the framing moved from a test to a charge. Meta has still not published a policy page naming which pages are affected, so the only way to know whether yours is included is to look at your own posting composer.
Why this matters for your business: If your social plan is to write a blog post and push a link to it on Facebook, you now get 24 of those a year. Stop spending them. Write the substance of the post into the Facebook post itself and let the people who want the full detail come and find the site. Check your composer this week, and if the notice is there, put the link in the first comment or your page bio and save the two you get for something that earns them.
The biggest ranking update of the quarter is running while the rank trackers are blind
Google started its September spam update on Thursday 24 September. It applies globally and in all languages, and the rollout takes up to two weeks, which makes it the longest Google has shipped this year. John Mueller confirmed the long window was deliberate rather than a mistake in the announcement.
Volatility duly showed up on Thursday and Friday. The problem is measuring it. Since around 13 September Google has been far more effective at blocking the tools that scrape search results. Nozzle reported losing roughly 80 percent of the data it could collect and Sistrix said much the same. Search Engine Land then reported the mechanism behind it. Google has rolled out a passthrough redirect on result links, which puts an extra hop between the search page and your site and breaks tools that read those links directly. The damage is uneven. Reddit’s tracked keyword count fell 25 percent month over month while its actual organic traffic stayed flat, and keywords sitting at position 51 or lower dropped 35 percent while position one rose 16 percent.
Why this matters for your business: Two things follow. Do not rebuild anything in response to rank movement over the next fortnight, because the update will not finish until roughly 8 October and reacting halfway through a rollout is how sites make matters worse. And if your monthly report leans on a third-party rank tracker, that report is now measuring the tool’s access to Google rather than your performance. Move the headline numbers into Search Console, which reads Google’s own data, and keep the tracker for competitor context only.
What turned out to be noise
AI Overviews are showing more links, but not necessarily to you
On Thursday we ran the finding that external links inside AI Overviews had climbed from almost zero to more than 25 percent. The number held up. Peec AI put it at 26 percent as a daily average across 25 August to 20 September.
The reading of it did not hold up. Search Engine Journal pointed out that the chart counts how often a link is displayed, not whether anyone clicked it, and that it does not separate links pointing at real websites from links pointing back into Google’s own AI Mode. Gagan Ghotra recorded examples where the underlined phrase led straight to AI Mode rather than to a publisher.
Why this matters for your business: More links in an AI Overview is not the same as more visits to you. Treat 26 percent as a display statistic until somebody publishes a breakdown of where those links actually go, and keep judging AI search on the one figure that pays your bills, which is the referral traffic arriving in your analytics.
The missing Search Console crawl stats were the glitch we said they were
Crawl stats for 15 September disappeared from every Search Console profile. We flagged it on Monday as a recurring reporting fault rather than anything happening to your site, and nothing has come out this week to change that reading.
Why this matters for your business: A missing day in a reporting chart is not a crawling problem. Before you spend an afternoon investigating a gap in Search Console, check whether everybody else is seeing the same gap, because a fault that hits everybody costs you nothing if you spot it and a full day if you assume it is yours.
Automotive
The repo rate moved on Thursday and your finance calculator did not
The Reserve Bank’s Monetary Policy Committee raised the repo rate by 25 basis points to 7.25 percent, unanimously, and the increase took effect on Thursday 25 September. Prime moves with it, to 10.75 percent.
Why this matters for your dealership: Every monthly instalment figure published on your website is now understated. That covers the finance calculator, the from R per month line on vehicle detail pages, any instalment baked into a banner image, and the figures inside your stock feed if you publish one. A buyer who gets a quote at the desk that is higher than the number on your site does not conclude that rates moved. They conclude you were not straight with them. Update the calculator’s base rate first, then sweep the static figures. While you are in there, check that your finance disclaimer names the rate it assumes, because a disclaimer written as at prime survives the next change on its own.
The friction is in the handover, not the enquiry form
Two studies landed in the same week and they point at the same gap. The Cars.co.za Industry Report 2026, launched at DealerCon, found affordability has overtaken brand loyalty as the deciding factor for South African buyers. CDK’s 2026 Friction Points Study found one in four customers who start a purchase online have to enter their information all over again when they reach the showroom, and that 72 percent of finance and insurance offices run four or more separate software systems to close a single deal.
Why this matters for your dealership: You are probably spending at the top of the funnel and losing people at the join. A buyer who completed a finance enquiry on your site and is then asked for the same details at a desk has just learned that the online step was theatre. Walk one real online enquiry all the way through to the desk this week and write down every point where something gets typed in again. Fixing the first one of those is usually cheaper than another month of ad spend. And with affordability now leading, the instalment figure is the headline, so put it at the top of your vehicle pages instead of burying it under specification.
Still unresolved
Four things from this week have not landed yet. They are worth watching rather than acting on.
- The September spam update is still rolling and will not finish until roughly 8 October, so no ranking position you see today is final.
- Meta has not said whether the Facebook link cap becomes standard for all unpaid pages or stays with the group seeing it now.
- Nobody knows whether third-party rank tracking data recovers, or whether the redirect change that broke it is permanent.
- Google added South Africa to its list of local advertising codes this month, so SA advertisers now sit under an extra compliance layer, but Google has not published how it intends to enforce it.
What to do this week
- Check your WordPress core version and update it if it is below 7.1.2, then look through your folders for files you do not recognise.
- Turn on automatic core updates on every site you run.
- Open your Facebook page composer and look for a link posting notice.
- Move your ranking reporting into Search Console for the next fortnight and leave the tracker out of client reports.
- Update the base rate in your finance calculator, then sweep every instalment figure on the site.
- Hold off on any structural SEO change until the spam update finishes in early October.
If you want a hand with any of it, from a WordPress security check to rebuilding a monthly report around Search Console data, get in touch.
Sources
Here are our own briefs from this week. Monday 21 September, Tuesday 22 September, Wednesday 23 September, Thursday 24 September, Friday 25 September.
- Patchstack on CVE-2026-87902 exploitation
- The Hacker News on the WordPress exploitation window
- Search Engine Roundtable on the September 2026 spam update
- Search Engine Land on Google’s passthrough redirect and SEO data
- Search Engine Journal on where AI Overview links actually go
- Social Media Today on Facebook link post limits
- SAnews on the repo rate rising to 7.25 percent
- Dealerfloor on the Cars.co.za Industry Report 2026
- CBT News on the CDK 2026 Friction Points Study