This is the news from Saturday 31 October. Read the latest news
Daily news
WordPress 7.1.4 flaw under attack, Bing’s AI controls and more
Today in 30 seconds
- WordPress 7.1.4 upgrade flaw is now under attack, so update today
- Bing lets you block AI training but still appear in AI answers
- OpenAI’s hidden “Aura” check can block your site from ChatGPT
- Reddit will hide more behind a login as Google traffic falls
- Mistral gives away the weights of its trillion-parameter Large 4
- Vercel Firewall now blocks AI crawlers and AI assistants separately
- Shopify lets you edit variants without leaving the product page
- ChatGPT ads reach 89 countries and get a wider desktop format
- Apple’s HomePod mini 2 goes on sale today
- Granola adds free, unlimited dictation on the Mac
Good morning, and happy Halloween. The scariest thing today is not a pumpkin. It is a WordPress flaw that attackers are now poking at, so let’s start there. After that, Bing gives you new AI switches, ChatGPT may be blocking sites without telling anyone, and Mistral gives away a giant model.
WordPress 7.1.4 upgrade flaw is now under attack, so update today
Attackers are now targeting the upgrade flaw fixed in WordPress 7.1.4, which came out on 28 October. Wordfence says it blocked 62,969 attacks on this bug in 24 hours. The flaw affects WordPress 4.7 through 7.1.3 and is rated 8.1 (high).
The bug sits in the folder WordPress uses to unpack a full core update. Attackers keep requesting files like setup-config.php there, hoping to catch the installer in the few seconds it is exposed. The window is narrow, but they only need to win once.
Why it matters Every WordPress site runs core updates, so every site is a target. Update to 7.1.4 now, then check your logs for odd requests to PHP files under wp-content/upgrade. Look for admin accounts, plugins or PHP files you don’t recognise.
If auto-updates are on, most sites will already be patched. I would still log in and check the version number. It takes ten seconds.
Bing lets you block AI training but still appear in AI answers
Microsoft has announced new Bing controls that split AI training from AI grounding. Training means your pages teach AI models. Grounding means your pages are used to write AI answers. You can now say yes to one and no to the other.
Training can be blocked in robots.txt with a new user agent called __usage_ai-training. Grounding is set per page with a meta tag such as <meta name="Bingbot" content="ai-grounding:disallow">, or the same rule in an X-Robots-Tag header. A “disallowextended” option allows grounding only in Microsoft’s own products. Bing starts honouring these on 1 February 2027.
Why it matters If you use NoArchive or NoCache today, Bing stops reading them as AI rules after 1 March 2027. Your normal Bing rankings are not affected by any of these settings.
My advice: most small businesses should keep grounding on, because AI answers are where people now find you. Training is your call. My guide on how AI search finds your site covers the bigger picture.
OpenAI’s hidden “Aura” check can block your site from ChatGPT
Search Engine Journal has found a safety check inside OpenAI’s tools, known internally as Aura. It decides if ChatGPT search or Codex Browser Use may open a website. If your domain is flagged, the tools refuse to visit it, whatever your robots.txt says.
The user sees messages like “Browser use is not permitted” on your domain. You see nothing, because the request never leaves OpenAI. Nobody outside OpenAI knows what triggers a block, and there is no self-service appeal.
Why it matters If ChatGPT can’t open your pages, it can’t recommend them. If you suspect a block, first rule out your own firewall and robots.txt rules. Then open a support case with OpenAI, with screenshots and logs as evidence.
Reddit will hide more behind a login as Google traffic falls
Reddit says its search referrals dropped by more than one million a week on average in October. US daily users fell to 50.7 million. In response, Reddit is moving to a mostly logged-in experience, with tests in some markets outside the US this quarter.
CEO Steve Huffman says the change protects Reddit’s data from AI scraping. Reddit has not yet decided how much stays visible to logged-out visitors. There is no date for a worldwide rollout.
Why it matters Reddit threads fill many Google results today. If they go behind a login, Google may show them less often. That could open up space for your own helpful pages and forum answers.
Mistral gives away the weights of its trillion-parameter Large 4
Mistral has released the open weights of Mistral Large 4, a 1-trillion-parameter model that reads text and images. It speaks more than 160 languages and has three reasoning levels. You can download it from Hugging Face or use it through Mistral’s API, OpenRouter and Microsoft Foundry.
The API costs $0.70 per million input tokens and $2.10 per million output tokens. Mistral says it ranks second only to Claude Opus 5.5 in a human preference test for code. These are Mistral’s own numbers. The licence allows commercial use, but companies reselling it as a hosted model need a separate deal.
Why it matters A top-tier model you can run on your own servers keeps your data in-house. For most small sites, the cheap API price is the more useful news.
Vercel Firewall now blocks AI crawlers and AI assistants separately
Vercel Firewall can now treat two kinds of AI bots differently. AI crawlers collect pages for indexing and model training. AI assistants fetch pages when a person asks a question. You can deny one group and allow or just log the other.
Turn on “AI Bots” under Security, Firewall, Rules, then set an action for each group. The CLI works too, with vercel firewall rules edit ai-bots. The ruleset is free on all plans. The same day, Vercel made Node.js 26 LTS the default for new projects.
Why it matters This is the same choice Bing offers above. Blocking training bots while letting assistants in keeps you visible in AI answers without feeding the models.
Shopify lets you edit variants without leaving the product page
Shopify has moved variant editing onto the product page. You can search, filter and group variants by option, and switch between a detail view and a table view. You can also change price and shipping for several variants at once.
Plus merchants can try it now through Test Drives, and they switch over on 12 December. Everyone else gets it gradually from December, with no setup needed.
Why it matters If you sell shirts in eight sizes and five colours, this saves a lot of clicking. It also makes price changes before the holiday rush much quicker.
ChatGPT ads reach 89 countries and get a wider desktop format
OpenAI’s latest note to advertisers says ChatGPT Ads now run in 89 countries, with more than 100,000 advertisers. A wider ad unit is rolling out on desktop, using existing campaigns with no changes needed. Multi-image ads are now in open beta for everyone.
The Shopify integration for ChatGPT Ads is also available outside the US now.
Why it matters ChatGPT is becoming a real ad channel, not a test. If you sell on Shopify, it may be worth a small trial budget to see how it compares with Google.
Apple’s HomePod mini 2 goes on sale today
Apple’s HomePod mini 2 is out on 30 October in the US for $149. It moves to the S10 chip, adds Wi-Fi 6E and comes in green, pink, blue, midnight and white. The top now glows in time with your music.
Two pairs can act as surround speakers with the new Apple TV 4K. It can also be the default speaker for Macs with Wi-Fi 6E. The new AI Siri is not ready yet and will come in a later update.
Why it matters It is a small upgrade, not a must-buy. If your first HomePod mini works fine, I would wait for the new Siri before spending.
Granola adds free, unlimited dictation on the Mac
Meeting notes app Granola now does voice dictation. Press the Fn key, speak, and Granola cleans up and formats your words before pasting them. It works in any app, from email to AI prompts.
It is free with unlimited words. It launched on the Mac on 29 October, with iOS and Windows coming “soon”.
Why it matters Paid dictation tools just got a free rival. If you write long AI prompts all day, talking is often faster than typing.
Quick hits
- Google Search may be bringing back the num=100 parameter in some form, though tests are mixed. Search Engine Roundtable
- Gemini stopped adding utm_source=gemini to cited links, so check your referrer data instead. Search Engine Roundtable
- AI Overviews sent about 0.9% clicks in a small opt-out test by Cyrus Shepard. Search Engine Roundtable
- Shopify admin now checks barcodes against GS1 and suggests marking real ones as GTINs. Shopify
- Claude API now accepts requests up to 128 MB on the Messages and Token Counting endpoints. Claude docs
- ElevenLabs SFX v3 handles prompts with several sounds better and makes cleaner audio. ElevenLabs
- Alexa gets more than 100 shopping skills, including subscription changes and delivery notes. TechCrunch
- Android 17 is on about 1% of devices after four months, while Android 16 passes 25%. 9to5Google
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Saturday 31 October. A newer edition is waiting for you.
Read the latest news → ← Friday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. If WordPress updates keep landing at bad times, my site updates service keeps your sites patched for you. And if Bing’s new AI switches have you scratching your head, my SEO service can set them up properly. Enjoy the lollies, and see you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.