The second half of September 2026 was the busiest stretch of the year. WordPress shipped two security releases, including a critical fix in 7.1.2, WooCommerce and PHP both shipped security updates, and xAI, Anthropic and OpenAI each released new models. Apple shipped iOS 26.7.1 for an exploited CoreGraphics flaw and an EU tracking prompt option, Stripe released the Endive API version, Android developer verification became required in four countries, and Angular published SSR advisories. This Release Brief covers each release with what it means for your website, store and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.1.1 | September 17, 2026 | Security and maintenance | Update now |
| WordPress 7.1.2 | September 22, 2026 | Critical security release | Update now |
| WooCommerce 11.1.1 and 11.1.2 | September 18 and 22, 2026 | Security releases | Update now |
| PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 | September 24, 2026 | Security release | Update now |
| App Tracking Transparency EU prompt | September 16, 2026 | Policy | Review tracking prompt |
| Grok Build memory (xAI) | September 16, 2026 | AI coding tool | Watch |
| Grok Voice Transcribe 2.0 (xAI) | September 18, 2026 | AI model | Pilot |
| Grok 4.7 (xAI) | September 21, 2026 | AI model | Pilot |
| Grok Team Bots (xAI) | September 28, 2026 | AI product (beta) | Watch |
| Claude Opus 5.5 (Anthropic) | September 22, 2026 | AI model | Pilot |
| Claude Sonnet 5.5 (Anthropic) | September 28, 2026 | AI model | Pilot |
| GPT-6 Sol and GPT-6 Luna (OpenAI) | September 22, 2026 | AI models | Pilot |
| GPT-6.1 Sol (OpenAI) | September 29, 2026 | AI model | Pilot |
| Angular security advisories | September 23, 2026 and Sep 30 | Security | Update Angular packages |
| iOS 26.7.1 | September 28, 2026 | Security | Update devices |
| Stripe API 2026-09-30.endive | September 30, 2026 | API version | Check plugin support |
| Android developer verification | September 30, 2026 | Requirement | Confirm registration |
WordPress 7.1.1 security and maintenance release
WordPress 7.1.1 was released on September 17, 2026, with 17 core bug fixes, 19 block editor bug fixes and 11 security fixes. The security fixes include a stored XSS that an unauthenticated visitor could plant through a comment, an authenticated path traversal in the REST templates controller and an arbitrary post overwrite by contributors. Sites with public comments, multisite networks or outside contributors should update first.
For the full write up, read our standalone post: WordPress 7.1.1 Fixes Comment XSS Plus 36 Core and Editor Bugs.
WordPress 7.1.2 critical security release
WordPress 7.1.2 was released on September 22, 2026, to fix one critical vulnerability that could let an unauthenticated attacker make page template resolution include a local PHP file, which can lead to remote code execution under the right conditions. The fix was backported to every eligible branch back to 4.7. Update every public site and confirm the version directly.
For the full write up, read our standalone post: WordPress 7.1.2 Patches an Unauthenticated Template Vulnerability.
WooCommerce 11.1.1 and 11.1.2 security releases
What shipped
WooCommerce released two security updates: 11.1.1 on September 18 and 11.1.2 on September 22, 2026, neither with a database update. 11.1.1 makes sure API credentials are used only for the REST API requests they are meant for, updates permission checks for the legacy options API and mobile app login, and strengthens guest session validation. 11.1.2 tightens validation around email based product reviews and fixes an infinite recursion in variation gallery rendering. Both require WordPress 7.0 or newer and PHP 7.4 or newer.
What it means for you
Most stores collect REST API keys for apps and integrations over the years, and these fixes tighten how those keys are checked.
How we use it in WordPress builds
For WooCommerce stores, we list the API keys on each store, revoke any that no longer belong to an active integration and confirm the rest still sync. We submit a review from an order email on staging and load variable product pages on themes with custom product templates.
What it means for mobile apps
11.1.1 updated permission checks for mobile app login, so we test sign in and account screens in AppPresser store apps after updating.
What to do next
- Update to 11.1.2 and review your API keys.
- Test review emails and variable product pages.
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 security releases
What shipped
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 were released on September 24, 2026, as security releases. PHP 8.5.11 and 8.4.26 fix 11 GitHub security advisories, and 8.3.35 and 8.2.34 fix 12. The shared fixes include TLS hostname verification falling back to the certificate CN after a SAN mismatch, a heap buffer overflow on a crafted wildcard CN, a cross origin credential leak in HTTP stream wrapper redirects, packet overreads in the mysqlnd wire protocol, an IPv6 ACL bypass in the FastCGI listen.allowed_clients setting, and SOAP, Phar and stream filter fixes.
What it means for you
These fixes protect secure connections to payment, email and API services, the database connection WordPress uses, and integrations that pass API keys in headers.
How we use it in WordPress builds
We patch PHP first, then test payment, email and API connections and database heavy pages such as search and checkout. We review custom integrations that open URLs with file_get_contents() or fopen() so secrets only go to the hosts that need them, and confirm PHP-FPM listens on a local socket or behind a firewall.
What it means for mobile apps
Every request from an AppPresser app to your site runs through PHP on the server, so patching the server covers the app's data too.
What to do next
- Ask your host to confirm the patched PHP version.
- Our WordPress security and hosting service handles PHP patching and testing.
Apple alternative tracking prompt in the EU
What shipped
On September 16, 2026, Apple announced an alternative App Tracking Transparency prompt for the European Union. Apple's post states:
- The alternative prompt arrives with iOS 27.2
- In Germany, France, Italy, Poland and Romania, only the alternative prompt is shown
What it means for you
If your app asks users for permission to track them, for example for ad attribution, the prompt users see in those countries will change.
How we use it in WordPress builds
No WordPress change is needed.
What it means for mobile apps
Most AppPresser apps do not ask for tracking permission. If yours does, we test the prompt on iOS 27.2 and update any explanation screens.
What to do next
- Check whether your app shows the tracking prompt
- Test it on iOS 27.2 with an EU region setting
Grok Build memory from xAI
What shipped
On September 16, 2026, xAI added memory to Grok Build, its agentic coding tool for the terminal. Grok Build writes notes about conventions, decisions and project facts as you work and stores them as markdown topic files, in a project scope and a global scope. The /dream command tidies the notes, /memory opens a read only browser of what it remembers, instructions in the current conversation take precedence, and secrets and short lived task state are excluded by design.
What it means for you
Coding sessions no longer start from a blank slate, so less time goes into explaining the same project context again.
How we use it in WordPress builds
On custom WordPress projects, memory keeps details like which folder holds the theme and how the team names hooks. We review stored notes with /memory so nothing outdated guides the next session.
What it means for mobile apps
The same consistency applies to AppPresser app projects, where custom code follows the conventions already set for the project.
What to do next
- Review what Grok Build remembers before a major change. Learn more about Grok.
Grok Voice Transcribe 2.0 from xAI
What shipped
On September 18, 2026, xAI released Grok Voice Transcribe 2.0, a speech to text model that xAI says is twice as accurate as version 1.0 at the same price. The slug is grok-voice-transcribe-2.0. It supports word level timestamps, speaker diarization at no extra cost, up to 8 audio channels, up to 100 key terms and dozens of languages. Pricing is $0.10 per hour of audio for batch and $0.20 per hour for streaming. xAI reports the word error rate on short phrases fell from 20.6 percent to 6.8 percent.
What it means for you
Meeting recordings, podcasts and support calls can become accurate, searchable text with each speaker labeled.
How we use it in WordPress builds
We can turn podcast and video audio into transcripts published on a WordPress site, with key terms set for names and products so they come out right.
What it means for mobile apps
AppPresser apps for podcasts and radio can show transcripts alongside episodes.
What to do next
- Test it on a few of your own recordings before switching.
Grok 4.7 from xAI
What shipped
On September 21, 2026, xAI released Grok 4.7, which it calls its most capable model for coding and knowledge work, at the same price and speed as Grok 4.6. It has a 500k token context window and reasoning effort settings of low, medium, high and xhigh. Pricing is $2 input, $0.50 cached input and $6 output per million tokens below 200k prompt tokens. It is available in Cursor, Grok Build, the xAI API as grok-4.7 and through cloud platforms. xAI says it is better at verifying its own work and scored 46.3 percent on CursorBench 4.0.
What it means for you
Long documents and multi step business tasks get more reliable results without a price increase.
How we use it in WordPress builds
For Grok integrations on WordPress, we use Grok 4.7 for content and data tasks that need checking, and choose the effort setting per task to balance cost and quality.
What it means for mobile apps
Features behind an AppPresser app can move to Grok 4.7 on the server side without a new app build.
What to do next
- Test Grok 4.7 on your current Grok tasks and compare results.
Grok Team Bots from xAI
What shipped
On September 28, 2026, xAI launched Team Bots in public beta on Teams and Enterprise plans. A Team Bot is shared by a whole team while each person's conversations stay private. Each one brings together context, plugins, credentials and memories, has its own Slack handle and counts a teammate's use against that person's own allowance. xAI also offered pre built Team Bots for sales, product management, marketing and data analytics.
What it means for you
A team can share one Bot built around a role, such as a sales assistant, without anyone seeing anyone else's conversations.
How we use it in WordPress builds
We can build a Team Bot around a client's brand guide and site documentation, so the whole content team works from the same instructions.
What it means for mobile apps
A Team Bot can support the people who manage an AppPresser app, with shared knowledge of its content and release process.
What to do next
- Pick one shared role for a pilot Team Bot.
Claude Opus 5.5 from Anthropic
What shipped
On September 22, 2026, Anthropic introduced Claude Opus 5.5, the first model in its Claude 5.5 family. Anthropic says it performs at the level of Claude Fable 5.1 on most work while costing 40 percent less to run than Opus 5. It has a 1M token context window, up to 128k output tokens and costs $4 input and $20 output per million tokens. Output is generated more than 30 percent faster than Opus 5. Anthropic reported that one early tester completed a 680,000 line code migration in less than a day.
What it means for you
Large modernization projects, such as moving old custom code to current standards, become faster and cheaper to plan and execute.
How we use it in WordPress builds
We use Opus 5.5 with Claude Code for large code migrations and WordPress modernization, with every change reviewed and tested on staging.
What it means for mobile apps
The same approach helps when updating older custom code behind an AppPresser app.
What to do next
- If you have a legacy codebase, scope a migration pilot.
Claude Sonnet 5.5 from Anthropic
What shipped
On September 28, 2026, Anthropic released Claude Sonnet 5.5, the second model in its Claude 5.5 family. Anthropic says it runs more than 30 percent faster and costs up to 30 percent less for most work than Sonnet 5. Pricing stays at $2 input and $10 output per million tokens. It scored 70.6 percent on Terminal-Bench 4.0, compared with 10.3 percent for Sonnet 5. Teams that ran Sonnet with thinking off need to switch to the between_tools setting before moving.
What it means for you
Everyday tasks like support replies, reports, documents and slides get faster and cheaper.
How we use it in WordPress builds
Sonnet 5.5 is our default Claude model for support and reporting work in WordPress, with the migration guide checked before switching an existing integration.
What it means for mobile apps
Faster replies help in app support assistants in AppPresser apps.
What to do next
- Check the thinking setting in existing integrations before switching.
GPT-6 Sol and GPT-6 Luna from OpenAI
What shipped
On September 22, 2026, OpenAI introduced GPT-6 Sol, a mid sized model for everyday professional work and coding, and GPT-6 Luna, a small, fast model for high volume tasks. Both launched in ChatGPT Work and Codex for paid plans and in the API as gpt-6-sol and gpt-6-luna, priced 50 percent below the GPT-5.6 models they follow. Sol costs $2 input and $10 output per million tokens; Luna costs $0.10 input and $0.50 output. OpenAI also added a 90 percent discount on cached input, a Prompt Caching Dashboard and explicit cache breakpoints.
What it means for you
Jobs that were too costly before, such as tagging an entire content library or drafting alt text for thousands of images, become affordable.
How we use it in WordPress builds
For ChatGPT and OpenAI integrations, we use Luna for bulk background jobs with results queued for review, and Sol for editorial help inside wp-admin. We place stable instructions ahead of the cache breakpoint to cut costs.
What it means for mobile apps
Luna suits search and summaries inside an AppPresser app, where per request cost matters at scale.
What to do next
- Compare Sol and Luna with your current model on real tasks.
GPT-6.1 Sol from OpenAI
What shipped
On September 29, 2026, OpenAI released GPT-6.1 Sol, an update to its mid sized GPT-6 model that OpenAI says delivers intelligence close to GPT-6 Astra at one fifth of Astra's price. It is available in ChatGPT Work and Codex for paid plans and in the API as gpt-6.1-sol, at $2 input, $0.10 cached input and $10 output per million tokens. OpenAI reported the share of responses containing errors at low reasoning effort fell from 11.4 percent to 7.7 percent.
What it means for you
Near flagship results for everyday work at a mid tier price.
How we use it in WordPress builds
For teams already on Sol, moving to GPT-6.1 Sol is mainly a model ID change followed by testing on real prompts. Teams on ChatGPT Work and Codex get it in their tools.
What it means for mobile apps
App features that call Sol through your WordPress site can switch on the server side without a new app build.
What to do next
- Test GPT-6.1 Sol on your current prompts, then update the model ID.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2026-101896 (high, September 23): SSR denial of service through numeric URL matrix parameters, in @angular/router, fixed in 22.2.0, 21.2.24 and 20.3.32
- CVE-2026-111752 (high, September 30): SSR denial of service from unmatched empty path outlet routes, in @angular/router
- CVE-2026-111754 (medium, September 30): open redirect through protocol relative URLs in SSR
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update to Angular 22.2.1, 21.2.25 or 20.3.33 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
iOS 26.7.1 fixes an exploited CoreGraphics flaw
What shipped
Apple released iOS 26.7.1 on September 28, 2026. Apple's security notes list:
- One CoreGraphics out of bounds write, CVE-2026-86950
- Apple says it may have been exploited in targeted attacks on versions before iOS 27
What it means for you
Devices that stay on iOS 26 need this update. Devices already on iOS 27 are not the target of the attacks Apple describes.
How we use it in WordPress builds
WordPress itself does not change. Many visitors reach your site in Safari on iPhone and iPad, so their device updates protect them while they browse and buy.
What it means for mobile apps
AppPresser apps run inside iOS, so an iOS security fix protects your app users as soon as they update. No new app build is needed for this release.
What to do next
- Update devices that stay on iOS 26 to 26.7.1.
- Keep at least one iOS 26 test device for app testing.
Stripe Endive API Version Removes payment_method_types From Checkout and Elements
What shipped
Stripe released API version 2026-09-30.endive on September 30, 2026. The changes most likely to affect stores:
- 2026-09-30.endive is the first Endive API version and introduces breaking changes; later Endive versions are additive only.
- The payment_method_types parameter was removed from Checkout Sessions, Payment Intents and Setup Intents.
- Elements no longer supports the paymentMethodTypes option.
- The payment request button is deprecated.
- Thin events for API v1 resources are generally available.
What it means for you
Code that lists payment methods directly will break on this version. The payment request button is deprecated in favor of newer Elements.
How we use it in WordPress builds
WooCommerce payment plugins decide which Stripe API version they use. We test plugin updates that adopt Endive on staging, including Apple Pay and Google Pay buttons.
What it means for mobile apps
AppPresser apps that use the site's checkout get the same buttons as the website. We test wallet payments inside the app after any Stripe plugin update.
What to do next
Do not upgrade the API version in the Stripe Dashboard by hand. Let the payment plugin manage it, and test checkout after each plugin update. Our WooCommerce team can help.
Android Developer Verification Becomes Required in Four Countries on September 30, 2026
What shipped
Android developer verification took effect on September 30, 2026:
- Starting September 30, 2026, app registration is required for installs from participating stores in Brazil, Indonesia, Singapore and Thailand.
- Enforcement covers seven participating app stores in those countries.
- Play developers had to register remaining apps in Play Console by September 30, 2026 to avoid global removal from Google Play.
- Google said over 99 percent of Play apps were registered automatically.
- Google plans to expand verification globally in 2027.
What it means for you
Apps that were not registered in Play Console could be removed from Google Play worldwide. Most apps were registered automatically.
How we use it in WordPress builds
Registration lives in Play Console, under the developer account. There is nothing to change in WordPress, but the account owner email should be one that someone checks.
What it means for mobile apps
We checked Play Console registration for each AppPresser app we publish.
What to do next
Open Play Console Home and confirm every app shows as registered. Our custom mobile app team can check.
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule. Our support and maintenance plans cover core, plugin and PHP updates, and our AI implementation team helps you choose and pilot models.
We also track the server, app platform and payment releases behind your site and app, including App Store, Angular, iOS, Stripe and Google Play. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Frequently asked questions
Which September update matters most?
WordPress 7.1.2. It fixed a critical vulnerability that needed no login, so every public site should have it.
Did WooCommerce 11.1.1 or 11.1.2 change the database?
No. Neither release includes a database update.
Does the Stripe Endive version break WooCommerce checkout?
Only for integrations that move to it. Stripe API versions apply when an account or plugin adopts them. Update the payment plugin when it supports Endive and test wallets such as Apple Pay. Our WooCommerce team can help.
Which Claude model should we use?
Opus 5.5 for large coding and migration work and Sonnet 5.5 for everyday tasks. Claude Fable 5.1, released September 15, 2026, is covered in our September 1 to 15 Release Brief.
Do new AI models require a new app build?
No. When AI features run through your WordPress site, the model can be changed on the server.
Brief us on your mission
Want security releases applied for you, or help choosing between Grok, Claude and ChatGPT for your project? Tell us about it and a specialist will follow up.
