A patch went out yesterday afternoon. Five hours later, automated scanners were knocking on WordPress sites looking for the ones that had not taken it. That is the shortest gap between a fix shipping and an attack starting we have seen on a WordPress core release.
SEO and search
A critical WordPress flaw went from patch to probe in five hours
WordPress 7.1.2 shipped on Tuesday with a fix for CVE-2026-87902, a path traversal flaw that lets an attacker read files off your server and, in the right conditions, run code on it. It scores 9.2 out of 10. No login is required. Every version from 4.7.0 through 7.1.1 is affected.
Patchstack saw the first probes arrive at 17:44 UTC the same day. The payloads match the exact encoding the patch addresses, so whoever built them was reading the code change rather than finding the bug independently. The traffic so far is reconnaissance, asking harmless core files whether a site is vulnerable. That is how these campaigns begin.
Why this matters for your business: Update to 7.1.2 today, or to the backport for your branch, which covers 7.0.6, 6.9.9 and 6.8.10. Then check your access logs for requests where the pagename parameter carries a double-encoded traversal. If we manage your hosting, this is already on our list for today.
AI Overviews now appear on nearly four in ten American desktop searches
Comscore’s second quarter data puts an AI Overview on 39.4 percent of Google searches in June, up from 25.8 percent in July last year, across 77 billion American desktop searches. The more useful finding sits further down. In the lodging category, Tripadvisor appeared as a source behind 61 percent of AI answers but was cited in only 21 percent of them. Google reads your page, uses what it finds, and does not always name you.
Why this matters for your business: That gap explains why your AI visibility tool and your analytics tell you different stories. Being used is not the same as being credited, and only one of those sends a visitor. This data is American, so read it as a direction of travel rather than a South African benchmark.
Social
Two AI agents got checkout rights on Shopify stores in one week
Google began emailing Merchant Center users on Tuesday to say their products were now eligible for native checkout inside AI Mode and Gemini. Eligible products were included automatically. Nobody opted in. In the same week, Shopify announced a partnership letting Meta’s Muse agents search Shopify stores, find products and negotiate prices using Shop Pay.
Why this matters for your business: Both moves are American for now, but the pattern is plain. Your product feed is becoming the thing that sells, not your product page. Google’s own documentation notes that direct checkout does not support client-side Google Analytics tracking, so a sale can now happen with no record of it in your reports. If you sell online, open your agentic settings this week and decide deliberately rather than by default.
Content
Township shoppers want lighter content, not bigger production
Rogerwilco’s Township CX Report 2026 surveyed 1,600 township residents nationally. 79 percent deal with electricity outages at least monthly. 66 percent are online throughout the day, yet 37 percent say the cost of data regularly stops them engaging with a brand at all. Only 20 percent believe brands help them cope with everyday difficulty. Affordability drove brand choice for 54 percent and quality for 53. WhatsApp promotions and low-data messages rank among the digital experiences they value most.
Why this matters for your business: Black Friday planning starts now, and the temptation is to put the budget into production. This research argues the other way. A light page that loads on a weak signal, a WhatsApp message instead of a heavy email, and an honest price will beat a campaign nobody can afford to download.
Your social links are pointing at the wrong page
Bitly surveyed 1,006 consumers alongside 501 marketers and creators. 61 percent of people expect a link in a social post to open a product page. Marketers deliver that 66 percent of the time and creators manage it 40 percent of the time. 79 percent of people have abandoned what they were doing because a link dropped them on a homepage instead of the thing they wanted.
Why this matters for your business: This is the cheapest conversion fix available to you. Work through your bio links, your scheduled posts and your influencer briefs, and point every one at the specific page the post is about. It costs nothing and it recovers people you are losing at the door.
Automotive
Affordability now outranks brand loyalty in South African car buying
The Cars.co.za Industry Report 2026 launched at DealerCon on Tuesday, built on site and lead data, a survey of more than 2,000 shoppers and Absa analysis of 2.56 million vehicle finance applications.
Chinese manufacturers grew sales 72 percent year on year in the second quarter against 3 percent for the established brands, and now hold roughly 22 percent of the market. Ford, Toyota, Nissan and Isuzu together have watched their share of finance applications slide from 84 percent to 75 percent in three years. Shoppers rank price first at 70.8 percent and fuel efficiency second at 52.5 percent. Discovery starts on social media, then moves to written reviews and test drives.
Why this matters for your dealership: Your site structure probably still reflects the market of five years ago. Build indexable landing pages around price bands and running cost rather than brand hierarchy, give the Chinese marques proper pages of their own, and make booking a test drive the primary action on a vehicle page instead of a generic enquiry form.
One in four buyers who start online start again in the showroom
CDK’s 2026 Friction Points Study found that 72 percent of finance and insurance offices run four or more software systems to complete a single deal. One in four customers who began online had to re-enter their details once they arrived in store, and those customers rate the dealership lower afterwards. One more number is worth sitting with. 80 percent of new vehicle buyers say they will come back for service, but only 30 percent leave with an appointment booked.
Why this matters for your dealership: Fill in your own enquiry form, then walk into your showroom and ask whether the data arrived. If it did not, you have a measurable leak between your website and your sales floor. And put a service booking option on your delivery confirmation page, because right now most of your service pipeline walks out the door.
What to do this week
- Update every WordPress site to 7.1.2, then read your access logs.
- Point every social and bio link at a specific product or service page.
- If you sell online, check your agentic checkout settings before Google decides for you.
- Plan your Black Friday creative for a weak signal and a tight data budget.
- Dealers, rebuild your landing pages around price and running cost.
If you want a hand with any of it, talk to us.
Sources
- Patchstack on CVE-2026-87902 probing
- Search Engine Land on the Comscore AI Overviews data
- Search Engine Land on native AI checkout
- Social Media Today on Meta Muse and Shopify
- The Media Online on the Township CX Report 2026
- Net Influencer on the Bitly Click Expectation Report
- Dealerfloor on the Cars.co.za Industry Report 2026
- CBT News on the CDK 2026 Friction Points Study