The second half of September 2026 was the busiest stretch of the year. WordPress shipped two security releases, including a critical fix in 7.1.2, PHP and WooCommerce both shipped security updates, and xAI, Anthropic and OpenAI each released new models. This roundup covers all 14 releases, security first, with what each means for your website, store and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.1.2 | September 22, 2026 | Critical security release | Update now |
| WordPress 7.1.1 | September 17, 2026 | Security and maintenance | Update now |
| PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 | September 24, 2026 | Security release | Update now |
| WooCommerce 11.1.1 and 11.1.2 | September 18 and 22, 2026 | Security releases | Update now |
| Claude Fable 5.1 (Anthropic) | September 15, 2026 | AI model | Pilot |
| Grok Bot 1Password and file uploads (xAI) | September 15, 2026 | AI product | Watch |
| Grok Build memory (xAI) | September 16, 2026 | AI coding tool | Watch |
| Grok Voice Transcribe 2.0 (xAI) | September 18, 2026 | AI model | Pilot |
| Grok 4.7 (xAI) | September 21, 2026 | AI model | Pilot |
| GPT-6 Sol and GPT-6 Luna (OpenAI) | September 22, 2026 | AI models | Pilot |
| Claude Opus 5.5 (Anthropic) | September 22, 2026 | AI model | Pilot |
| Claude Sonnet 5.5 (Anthropic) | September 28, 2026 | AI model | Pilot |
| Grok Team Bots (xAI) | September 28, 2026 | AI product (beta) | Watch |
| GPT-6.1 Sol (OpenAI) | September 29, 2026 | AI model | Pilot |
WordPress 7.1.2 critical security release
What shipped
WordPress 7.1.2 was released on September 22, 2026, to fix one critical severity vulnerability. Under certain conditions, an unauthenticated attacker could make page template resolution include a chosen readable local PHP file outside the active theme directories, which can lead to remote code execution if the right server and theme conditions are met. The fix was backported to every branch eligible for security fixes, back to 4.7.
What it means for you
Critical and unauthenticated is the combination that matters most. No login is needed, so every public site on an affected version should be updated whether or not you think the conditions apply to your theme.
How we use it in WordPress builds
On custom WordPress builds, we roll 7.1.2 out as fast as we can, confirm the version on each site directly because automatic updates can be blocked by file permissions or settings in code, and review custom themes and plugins that filter template loading so templates only come from the theme's own folders.
What it means for mobile apps
AppPresser apps rely on the WordPress site behind them, so a patched site protects the app's content source. No app store update is needed.
What to do next
- Confirm every site shows 7.1.2 or later, not just that automatic updates are on.
- Have custom template code reviewed on staging after the update.
WordPress 7.1.1 security and maintenance release
What shipped
WordPress 7.1.1 was released on September 17, 2026, with 17 core bug fixes, 19 block editor bug fixes and 11 security fixes. Highlights include a stored XSS in wpautop() that an unauthenticated visitor could plant through a comment (subject to approval), a stored XSS in some themes with custom headers, crafted URLs that could install and preview an inactive theme, site administrators network activating network only plugins, an authenticated path traversal in the REST templates controller, XML-RPC publishing of Customizer changesets that bypassed edit_css checks, an arbitrary post overwrite by contributors, and disclosure of private details to any logged in user.
What it means for you
This release touches comments, themes, multisite and the REST API, so it reaches almost every kind of site. Sites with public comments, multisite networks or outside contributors should update first.
How we use it in WordPress builds
After updating we spot check comment formatting, test template editing in the Site Editor, confirm role permissions on staging and review active network plugins on multisite networks. On sites that do not use XML-RPC, we turn it off. We also remove unused themes, since every installed theme is more code to patch.
What it means for mobile apps
Apps and headless front ends that read templates or content through the REST API should be retested after the update, which we do as part of the staging check.
What to do next
- Update now and confirm moderation keeps new comments in review.
- Remove themes you do not use.
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 security releases
What shipped
PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 were released on September 24, 2026, as security releases. PHP 8.5.11 and 8.4.26 fix 11 GitHub security advisories, and 8.3.35 and 8.2.34 fix 12. The shared fixes include TLS hostname verification falling back to the certificate CN after a SAN mismatch, a heap buffer overflow on a crafted wildcard CN, a cross origin credential leak in HTTP stream wrapper redirects, packet overreads in the mysqlnd wire protocol, an IPv6 ACL bypass in the FastCGI listen.allowed_clients setting, and SOAP, Phar and stream filter fixes.
What it means for you
These fixes protect secure connections to payment, email and API services, the database connection WordPress uses, and integrations that pass API keys in headers.
How we use it in WordPress builds
We patch PHP first, then test payment, email and API connections and database heavy pages such as search and checkout. We review custom integrations that open URLs with file_get_contents() or fopen() so secrets only go to the hosts that need them, and confirm PHP-FPM listens on a local socket or behind a firewall.
What it means for mobile apps
Every request from an AppPresser app to your site runs through PHP on the server, so patching the server covers the app's data too.
What to do next
- Ask your host to confirm the patched PHP version.
- Our WordPress security and hosting service handles PHP patching and testing.
WooCommerce 11.1.1 and 11.1.2 security releases
What shipped
WooCommerce released two security updates: 11.1.1 on September 18 and 11.1.2 on September 22, 2026, neither with a database update. 11.1.1 makes sure API credentials are used only for the REST API requests they are meant for, updates permission checks for the legacy options API and mobile app login, and strengthens guest session validation. 11.1.2 tightens validation around email based product reviews and fixes an infinite recursion in variation gallery rendering. Both require WordPress 7.0 or newer and PHP 7.4 or newer.
What it means for you
Most stores collect REST API keys for apps and integrations over the years, and these fixes tighten how those keys are checked.
How we use it in WordPress builds
For WooCommerce stores, we list the API keys on each store, revoke any that no longer belong to an active integration and confirm the rest still sync. We submit a review from an order email on staging and load variable product pages on themes with custom product templates.
What it means for mobile apps
11.1.1 updated permission checks for mobile app login, so we test sign in and account screens in AppPresser store apps after updating.
What to do next
- Update to 11.1.2 and review your API keys.
- Test review emails and variable product pages.
Claude Fable 5.1 from Anthropic
What shipped
On September 15, 2026, Anthropic released Claude Fable 5.1 on the Claude API and partner clouds, alongside Claude Mythos 5.1 for verified organizations. Fable 5.1 has a 1M token context window, up to 128k output tokens and always on adaptive thinking. It costs $10 per million input tokens and $50 per million output tokens, with cache reads at $0.25 per million, which Anthropic estimates makes typical workloads about 25 percent cheaper. Forced tool use returns an error, so integrations that force a specific tool need updating.
What it means for you
Very large documents, codebases or knowledge bases can be worked on in one pass, and cheaper caching lowers the cost of repeated instructions.
How we use it in WordPress builds
For Claude integrations, we use Fable 5.1 for long research and document work where its context window matters, and check existing integrations for forced tool use before switching.
What it means for mobile apps
Fable 5.1 suits back end jobs behind an app, such as building summaries from large content libraries, rather than live in app replies.
What to do next
- Reserve Fable 5.1 for the hardest long jobs and use lower cost models elsewhere.
Grok Bot 1Password sign in and file uploads from xAI
What shipped
On September 15, 2026, Grok Bot version 0.53.0 from xAI let Bots on a Mac sign in with logins saved in 1Password, connected from the Marketplace. The Bot asks first before using a login unless you turn on Auto fill. Bots can upload files to Google Drive or OneDrive or attach them to a Gmail draft, and the Bot's computer uses your time zone. Version 0.52.0 added pausing and resuming routines.
What it means for you
A Bot can sign into the sites your team uses without you typing each password, and deliver finished files where your team keeps them.
How we use it in WordPress builds
With Grok Bot, we keep login approval on so a person confirms each sign in, and use Drive or OneDrive uploads for reports a Bot builds from WordPress data.
What it means for mobile apps
A Bot can drop app store reports for an AppPresser app straight into the team's shared folder.
What to do next
- Share only the logins a Bot needs and keep Auto fill off at first.
Grok Build memory from xAI
What shipped
On September 16, 2026, xAI added memory to Grok Build, its agentic coding tool for the terminal. Grok Build writes notes about conventions, decisions and project facts as you work and stores them as markdown topic files, in a project scope and a global scope. The /dream command tidies the notes, /memory opens a read only browser of what it remembers, instructions in the current conversation take precedence, and secrets and short lived task state are excluded by design.
What it means for you
Coding sessions no longer start from a blank slate, so less time goes into explaining the same project context again.
How we use it in WordPress builds
On custom WordPress projects, memory keeps details like which folder holds the theme and how the team names hooks. We review stored notes with /memory so nothing outdated guides the next session.
What it means for mobile apps
The same consistency applies to AppPresser app projects, where custom code follows the conventions already set for the project.
What to do next
- Review what Grok Build remembers before a major change. Learn more about Grok.
Grok Voice Transcribe 2.0 from xAI
What shipped
On September 18, 2026, xAI released Grok Voice Transcribe 2.0, a speech to text model that xAI says is twice as accurate as version 1.0 at the same price. The slug is grok-voice-transcribe-2.0. It supports word level timestamps, speaker diarization at no extra cost, up to 8 audio channels, up to 100 key terms and dozens of languages. Pricing is $0.10 per hour of audio for batch and $0.20 per hour for streaming. xAI reports the word error rate on short phrases fell from 20.6 percent to 6.8 percent.
What it means for you
Meeting recordings, podcasts and support calls can become accurate, searchable text with each speaker labeled.
How we use it in WordPress builds
We can turn podcast and video audio into transcripts published on a WordPress site, with key terms set for names and products so they come out right.
What it means for mobile apps
AppPresser apps for podcasts and radio can show transcripts alongside episodes.
What to do next
- Test it on a few of your own recordings before switching.
Grok 4.7 from xAI
What shipped
On September 21, 2026, xAI released Grok 4.7, which it calls its most capable model for coding and knowledge work, at the same price and speed as Grok 4.6. It has a 500k token context window and reasoning effort settings of low, medium, high and xhigh. Pricing is $2 input, $0.50 cached input and $6 output per million tokens below 200k prompt tokens. It is available in Cursor, Grok Build, the xAI API as grok-4.7 and through cloud platforms. xAI says it is better at verifying its own work and scored 46.3 percent on CursorBench 4.0.
What it means for you
Long documents and multi step business tasks get more reliable results without a price increase.
How we use it in WordPress builds
For Grok integrations on WordPress, we use Grok 4.7 for content and data tasks that need checking, and choose the effort setting per task to balance cost and quality.
What it means for mobile apps
Features behind an AppPresser app can move to Grok 4.7 on the server side without a new app build.
What to do next
- Test Grok 4.7 on your current Grok tasks and compare results.
GPT-6 Sol and GPT-6 Luna from OpenAI
What shipped
On September 22, 2026, OpenAI introduced GPT-6 Sol, a mid sized model for everyday professional work and coding, and GPT-6 Luna, a small, fast model for high volume tasks. Both launched in ChatGPT Work and Codex for paid plans and in the API as gpt-6-sol and gpt-6-luna, priced 50 percent below the GPT-5.6 models they follow. Sol costs $2 input and $10 output per million tokens; Luna costs $0.10 input and $0.50 output. OpenAI also added a 90 percent discount on cached input, a Prompt Caching Dashboard and explicit cache breakpoints.
What it means for you
Jobs that were too costly before, such as tagging an entire content library or drafting alt text for thousands of images, become affordable.
How we use it in WordPress builds
For ChatGPT and OpenAI integrations, we use Luna for bulk background jobs with results queued for review, and Sol for editorial help inside wp-admin. We place stable instructions ahead of the cache breakpoint to cut costs.
What it means for mobile apps
Luna suits search and summaries inside an AppPresser app, where per request cost matters at scale.
What to do next
- Compare Sol and Luna with your current model on real tasks.
Claude Opus 5.5 from Anthropic
What shipped
On September 22, 2026, Anthropic introduced Claude Opus 5.5, the first model in its Claude 5.5 family. Anthropic says it performs at the level of Claude Fable 5.1 on most work while costing 40 percent less to run than Opus 5. It has a 1M token context window, up to 128k output tokens and costs $4 input and $20 output per million tokens. Output is generated more than 30 percent faster than Opus 5. Anthropic reported that one early tester completed a 680,000 line code migration in less than a day.
What it means for you
Large modernization projects, such as moving old custom code to current standards, become faster and cheaper to plan and execute.
How we use it in WordPress builds
We use Opus 5.5 with Claude Code for large code migrations and WordPress modernization, with every change reviewed and tested on staging.
What it means for mobile apps
The same approach helps when updating older custom code behind an AppPresser app.
What to do next
- If you have a legacy codebase, scope a migration pilot.
Claude Sonnet 5.5 from Anthropic
What shipped
On September 28, 2026, Anthropic released Claude Sonnet 5.5, the second model in its Claude 5.5 family. Anthropic says it runs more than 30 percent faster and costs up to 30 percent less for most work than Sonnet 5. Pricing stays at $2 input and $10 output per million tokens. It scored 70.6 percent on Terminal-Bench 4.0, compared with 10.3 percent for Sonnet 5. Teams that ran Sonnet with thinking off need to switch to the between_tools setting before moving.
What it means for you
Everyday tasks like support replies, reports, documents and slides get faster and cheaper.
How we use it in WordPress builds
Sonnet 5.5 is our default Claude model for support and reporting work in WordPress, with the migration guide checked before switching an existing integration.
What it means for mobile apps
Faster replies help in app support assistants in AppPresser apps.
What to do next
- Check the thinking setting in existing integrations before switching.
Grok Team Bots from xAI
What shipped
On September 28, 2026, xAI launched Team Bots in public beta on Teams and Enterprise plans. A Team Bot is shared by a whole team while each person's conversations stay private. Each one brings together context, plugins, credentials and memories, has its own Slack handle and counts a teammate's use against that person's own allowance. xAI also offered pre built Team Bots for sales, product management, marketing and data analytics.
What it means for you
A team can share one Bot built around a role, such as a sales assistant, without anyone seeing anyone else's conversations.
How we use it in WordPress builds
We can build a Team Bot around a client's brand guide and site documentation, so the whole content team works from the same instructions.
What it means for mobile apps
A Team Bot can support the people who manage an AppPresser app, with shared knowledge of its content and release process.
What to do next
- Pick one shared role for a pilot Team Bot.
GPT-6.1 Sol from OpenAI
What shipped
On September 29, 2026, OpenAI released GPT-6.1 Sol, an update to its mid sized GPT-6 model that OpenAI says delivers intelligence close to GPT-6 Astra at one fifth of Astra's price. It is available in ChatGPT Work and Codex for paid plans and in the API as gpt-6.1-sol, at $2 input, $0.10 cached input and $10 output per million tokens. OpenAI reported the share of responses containing errors at low reasoning effort fell from 11.4 percent to 7.7 percent.
What it means for you
Near flagship results for everyday work at a mid tier price.
How we use it in WordPress builds
For teams already on Sol, moving to GPT-6.1 Sol is mainly a model ID change followed by testing on real prompts. Teams on ChatGPT Work and Codex get it in their tools.
What it means for mobile apps
App features that call Sol through your WordPress site can switch on the server side without a new app build.
What to do next
- Test GPT-6.1 Sol on your current prompts, then update the model ID.
How AlphaWeb handles updates for you
We follow WordPress, PHP, WooCommerce and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule. Our support and maintenance plans cover core, plugin and PHP updates, and our AI implementation team helps you choose and pilot models.
Frequently asked questions
Which September update matters most?
WordPress 7.1.2. It fixed a critical vulnerability that needed no login, so every public site should have it.
Did WooCommerce 11.1.1 or 11.1.2 change the database?
No. Neither release includes a database update.
Which Claude model should we use?
Opus 5.5 for large coding and migration work, Sonnet 5.5 for everyday tasks, and Fable 5.1 for the longest research and document jobs.
Do new AI models require a new app build?
No. When AI features run through your WordPress site, the model can be changed on the server.
Brief us on your mission
Want security releases applied for you, or help choosing between Grok, Claude and ChatGPT for your project? Tell us about it and a specialist will follow up.
