The second half of May 2026 brought WordPress 7.0, which builds AI into core, redesigns the dashboard and raises the minimum PHP version to 7.4, and WooCommerce 10.8, which requires WordPress 6.9, followed a day later by 10.8.1. On the server side, nginx 1.30.2 and 1.31.1 closed a rewrite buffer overflow, MariaDB 12.3 became the new LTS, MariaDB fixed Galera security flaws, and Angular shipped a batch of security advisories. Here is what shipped and what it means for your website, store and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.0 "Armstrong" | May 20, 2026 | Major release | Plan and test |
| WooCommerce 10.8 | May 26, 2026 | Feature release | See standalone post |
| WooCommerce 10.8.1 | May 27, 2026 | Fix release | Update to 10.8.1 |
| nginx 1.30.2 and 1.31.1 | May 22, 2026 | Security | Update again |
| Angular security advisories | May 23, 2026 and May 28 | Security | Update Angular packages |
| MariaDB 10.6.27, 10.11.18, 11.4.12, 11.8.8 | May 28, 2026 and 29 | Security | Update MariaDB |
| MariaDB 12.3 LTS | May 29, 2026 | LTS release | Plan an LTS move |
WordPress 7.0 "Armstrong" major release
WordPress 7.0, code named "Armstrong", was released on May 20, 2026. It builds a provider agnostic AI Client and a Connectors screen into core, redesigns the dashboard and raises the minimum PHP version to 7.4. Confirm your server runs PHP 7.4 or newer before you update.
For the full write up, read our standalone post: WordPress 7.0: AI Built Into Core, a New Dashboard and PHP 7.4 Minimum.
WooCommerce 10.8
WooCommerce 10.8 was released on May 26, 2026, and requires WordPress 6.9 or newer, with PHP 7.4 still the minimum. It aligns the admin with WordPress 7.0, adds storefront query and index work and adds an optional Customer Review Request email that is off by default.
For the full write up, read our standalone post: WooCommerce 10.8.
WooCommerce 10.8.1 fixes
What shipped
WooCommerce 10.8.1 was released on May 27, 2026. It restores the WooPayments onboarding flow after a dropdown regression stopped new merchants at the legal entity type step, and fixes a fatal PHP error logged during in place upgrades from 10.7 to 10.8. WooCommerce noted the upgrade itself still completed and WP-CLI upgrades were not affected.
What it means for you
New stores setting up WooPayments could not finish onboarding on 10.8.0. Existing stores may have seen a fatal error in the logs during the upgrade even though the upgrade completed.
How we use it in WordPress builds
After moving stores to 10.8.1, we review the PHP error log and WooCommerce logs to separate harmless update notices from real problems.
What it means for mobile apps
No app changes are needed. Store apps keep using the same checkout and payment methods.
What to do next
- Update to WooCommerce 10.8.1 or later.
- Review your error log for the upgrade notice and clear it.
- Let our support and maintenance team handle the update.
nginx 1.30.2 and 1.31.1 Close a Buffer Overflow in the Rewrite Module
What shipped
Nine days after the May 13 releases, nginx.org shipped another pair on May 22, 2026:
- nginx 1.30.2 and 1.31.1 were released May 22, 2026.
- Both fix CVE-2026-9256, a buffer overflow in the rewrite module rated medium.
- The release came nine days after 1.30.1 and 1.31.0.
What it means for you
Servers patched on May 13 needed a second update. Rewrite rules are common, so the exposure is wide.
How we use it in WordPress builds
We treat rewrite module fixes as urgent on WordPress hosts because redirects and pretty permalinks run through them.
What it means for mobile apps
No app change. Deep links that resolve through server redirects keep working after the update.
What to do next
Update to 1.30.2 or 1.31.1 or later even if you patched in mid May. Our WordPress security and hosting service handles back to back patches like this.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2026-49241 (critical, May 23) and CVE-2026-50178 (high): the VS Code Angular Language Service extension, fixed in 21.2.4
- CVE-2026-50168 (high): SSRF allowlist bypass in platform-server
- CVE-2026-50170 (high): information leak through default caching of credentialed requests
- CVE-2026-50171 (high): number formatting denial of service
- CVE-2026-50169 and CVE-2026-50184 (service worker) and CVE-2026-52725 (dynamic component mounting protection bypass), rated medium
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update the framework to Angular 21.2.15, 20.3.22 or 19.2.23 or later, and the VS Code extension to 21.2.4 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
MariaDB corrective releases for Galera security flaws
What shipped
MariaDB published corrective releases 10.6.27, 10.11.18, 11.4.12 and 11.8.8. MariaDB's announcement states:
- They fix high severity Galera flaws CVE-2026-49261, CVE-2026-48165 and CVE-2026-48163
- The flaws involve wsrep_notify_cmd, wsrep_sst_receive_address and the rsync SST donor
- MariaDB 12.3 is not affected
- They follow the May 18 maintenance releases 10.6.26, 10.11.17, 11.4.11 and 11.8.7
What it means for you
These flaws matter for servers running Galera clustering, which some high availability WordPress hosts use. Single server databases should still take the update.
How we use it in WordPress builds
On clustered hosting we manage, we roll database updates node by node to avoid downtime. This is part of our WordPress security and hosting work.
What it means for mobile apps
This is a server side change. It does not change how an AppPresser app is built, but your app reads its content and login sessions from your WordPress site, so the same server patch protects the app's data too.
What to do next
- Ask your host if your database uses Galera
- Update to the corrective release for your MariaDB line
MariaDB 12.3 LTS Arrives With Snapshot Isolation On by Default
What shipped
The MariaDB Foundation announced 12.3 as its newest long term support series in May 2026. Key points:
- MariaDB 12.3.2, the first stable release of the 12.3 LTS series, is listed on mariadb.org with a release date of May 29, 2026.
- innodb_snapshot_isolation now defaults to ON, so applications that depend on REPEATABLE READ behavior should be tested.
- mariadb.org lists Community maintenance for 12.3 until June 12, 2029.
- Maintenance releases for 10.6, 10.11, 11.4 and 11.8 also shipped in late May 2026.
What it means for you
12.3 is the LTS to plan toward, with community support into 2029. The snapshot isolation default can turn some silent data races into errors, so test before upgrading.
How we use it in WordPress builds
WordPress core works on MariaDB 12.3, but plugins that run long transactions, such as some stock and booking plugins, should be tested on staging with the new default.
What it means for mobile apps
Apps reach the database only through WordPress. Testing should cover app actions that write data, such as orders and bookings.
What to do next
Keep production on a maintained LTS such as 11.8 or 11.4 until plugins pass on 12.3 in staging. Our WordPress security and hosting team can run that test.
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule. Hosting and PHP upgrades are covered by our WordPress security and hosting service.
We also track the server, app platform and payment releases behind your site and app, including nginx, Angular and MariaDB. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Frequently asked questions
Can I run WooCommerce 10.8 on WordPress 6.8?
No. WooCommerce 10.8 requires WordPress 6.9 or newer.
Is the Customer Review Request email on by default?
No. It is disabled by default and must be enabled under WooCommerce, Settings, Emails.
Should we upgrade to MariaDB 12.3 right away?
Not right away. 12.3 is supported until 2029, but snapshot isolation is now on by default. Test plugins that write data on staging first.
Brief us on your mission
Planning your move to WordPress 7.0 and WooCommerce 10.8? Tell us about your site or store and a specialist will follow up.
