Between February 1 and February 15, 2026, WordPress 6.9.1 fixed 49 bugs, WooCommerce 10.5 shipped with follow ups 10.5.1 and 10.5.2, Apple set the iOS 26 SDK as the upload minimum from April 28, nginx 1.28.2 and 1.29.5 fixed a response injection flaw, and iOS 26.3 fixed a dyld flaw Apple says may have been exploited. Act on this first: WooCommerce stores should land on 10.5.2, which fully reverts the change that stopped some stores from adding variable products to the cart.
Below is a quick summary table, then a section for each release covering what shipped, what it means for you, how we use it in WordPress builds, what it means for mobile apps and what to do next. Each WordPress core release gets a short summary here and a link to its own post.
At a glance
| Release | Date | Type | Who should care | Action |
|---|---|---|---|---|
| WordPress 6.9.1 | Feb 3 | Maintenance | Every WordPress site, especially sites that send email or run a classic theme | Update and test |
| WooCommerce 10.5 | Feb 4 | Feature | Every WooCommerce store, especially stores with variable products | See standalone post |
| WooCommerce 10.5.1 and 10.5.2 | Feb 10 and Feb 13 | Fix release | Stores with variable products | Update to 10.5.2 |
| iOS 26 SDK minimum | Feb 3 | Requirement | iOS app owners | Rebuild with Xcode 26 |
| nginx 1.28.2 and 1.29.5 | Feb 4 | Security | Servers proxying to HTTPS backends | Update nginx |
| iOS 26.3 | Feb 11 | Security | Every iPhone and iPad user | Update devices |
WordPress 6.9.1 maintenance release
WordPress 6.9.1 was released on February 3, 2026, as a maintenance release that fixes 49 bugs across core and the block editor, including mail and classic theme issues, with no new features. After updating, test contact forms, password resets and store receipts, and check sites that still run a classic theme.
For the full write up, read our standalone post: WordPress 6.9.1 Fixes Block Editor, Email Delivery and Classic Themes.
WooCommerce 10.5
WooCommerce 10.5 was released on February 4, 2026. New stores now import Analytics data in 12 hour batches, the Checkout block shows thumbnails for multi package shipments, and the release brings admin and storefront performance work. Minimum requirements stay at WordPress 6.8 and PHP 7.4.
For the full write up, read our standalone post: WooCommerce 10.5.
WooCommerce 10.5.1 and 10.5.2 fixes
What shipped
WooCommerce 10.5 disabled the Add to Cart button on variable products until the variation script loaded, and stores that customized or dequeued that script could not add variable products to the cart. WooCommerce 10.5.1, released on February 10, 2026, narrowed the change, reverted the Recent Reviews widget to its previous version, fixed the shop page in the Divi theme and added token validation to the PayPal Standard shipping callback. WooCommerce 10.5.2, released on February 13, 2026, reverted the original change entirely.
What it means for you
A store that cannot add products to the cart is losing money every minute, which is why 10.5.2 is the release to install.
How we use it in WordPress builds
Variable product checks are part of every WooCommerce update we run. For this release we added variable products with each attribute combination to the cart on staging before moving any client store forward.
What it means for mobile apps
Apps that offer in app shopping use the same add to cart flow, so we test variable products inside the app as part of the same staging check.
What to do next
- Install WooCommerce 10.5.2.
- Add a variable product to the cart on your live store and confirm checkout works.
- Let our support and maintenance team handle staged WooCommerce updates for you.
App Store Uploads Required the iOS 26 SDK Starting April 28, 2026
What shipped
On February 3, 2026, Apple set the next SDK floor for App Store Connect uploads:
- Apple announced on February 3, 2026 that apps uploaded to App Store Connect starting April 28, 2026 must meet new minimums.
- iOS and iPadOS apps must be built with the iOS 26 and iPadOS 26 SDK or later.
- tvOS, visionOS and watchOS apps must be built with their 26 SDKs or later.
- Apple said in July 2025 that watchOS apps uploaded from April 2026 must also include 64 bit support.
What it means for you
After April 28, 2026, an app built with an older SDK could not be uploaded, even for a small fix. Building with the new SDK also brings in the iOS 26 design changes, so screens need a review.
How we use it in WordPress builds
Nothing changes on the WordPress side. The deadline is about how the app binary is built.
What it means for mobile apps
Every AppPresser app had to be rebuilt with Xcode 26 before its next update after April 28. We test each build for layout changes from the new SDK before it goes to review.
What to do next
If your app has not shipped an update built with Xcode 26, schedule one now so an urgent fix is not blocked. See how we handle App Store submission for WordPress apps.
nginx 1.28.2 and 1.29.5 Fix a Response Injection Flaw in SSL Upstreams
What shipped
nginx.org released stable 1.28.2 and mainline 1.29.5 on February 4, 2026 with one security fix:
- nginx 1.28.2 (stable) and 1.29.5 (mainline) were released February 4, 2026.
- Both fix CVE-2026-1642 in proxying to SSL backends.
- An attacker might inject plain text data into the response from an SSL backend.
What it means for you
The flaw affects nginx when it proxies requests to a backend over SSL. A site behind a load balancer or a separate application server is the typical setup at risk.
How we use it in WordPress builds
Some of our WordPress stacks put nginx in front of PHP on another server or in front of an object cache over TLS. Those setups get this patch first. Single server sites that pass requests to PHP over FastCGI do not use the affected path.
What it means for mobile apps
App traffic hits the same nginx front end as the website. If the server proxies to an SSL backend, patching it protects the REST API responses the app depends on.
What to do next
Check whether your nginx config uses proxy_pass with https upstreams. If it does, update to 1.28.2 or 1.29.5 or later. Our WordPress security and hosting plans cover this.
iOS 26.3 fixes an exploited dyld flaw
What shipped
Apple released iOS 26.3 and iPadOS 26.3 on February 11, 2026. Apple's security notes list:
- At least 43 CVE IDs
- CVE-2026-20700 in dyld, which Apple says may have been exploited in targeted attacks
What it means for you
A flaw that may already have been exploited is the strongest reason to update phones and tablets quickly, especially devices used to run your site or store.
How we use it in WordPress builds
WordPress itself does not change. Many visitors reach your site in Safari on iPhone and iPad, so their device updates protect them while they browse and buy.
What it means for mobile apps
AppPresser apps run inside iOS, so an iOS security fix protects your app users as soon as they update. No new app build is needed for this release.
What to do next
- Update team and test devices to iOS 26.3 or later.
- Retest your app on 26.3 before your next submission.
How AlphaWeb handles updates for you
A maintenance release and a feature release with two follow ups in the same two weeks is a normal pace, and the follow ups are where a store can get caught out. Our support and maintenance plans cover tested WordPress core, theme and plugin updates on staging first, then in production, with uptime monitoring and help when something breaks. Our WordPress security and hosting service keeps PHP versions and servers current, and our custom WordPress development and custom mobile apps teams put new features to work when they fit.
We also track the server, app platform and payment releases behind your site and app, including App Store, nginx and iOS. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Request a custom development quote, or tell us about your project through our Mission Brief.
Frequently asked questions
Did the iOS 26 SDK rule affect apps that were already live?
No. Live apps stay on the store. The rule applies to uploads starting April 28, 2026, so your next update after that date must be built with Xcode 26.
Brief Us on Your Mission
Want to talk about a website, mobile app, migration or AI project? Fill out the Mission Brief and a specialist will follow up to schedule a call and put together a free quote.
