GPT-6 for everyone, Claude Haiku 5.5 and an npm wiper worm

Claude Haiku 5.5 costs 90% less than Haiku 4.5 on most jobs

Anthropic released Claude Haiku 5.5 on 7 October. For prompts up to 100k tokens, it costs US$0.10 per million input tokens and US$0.50 per million output tokens. Haiku 4.5 cost US$1 and US$5. The model ID is claude-haiku-5-5, and it is on the Claude API, AWS, Google Cloud and Azure.

It is the first Haiku with an adjustable effort setting. On the OSWorld 2.1 computer use test it scores 72.4%, up from 15.7% for Haiku 4.5. Anthropic also halved cache read prices for Sonnet 5.5. GitHub Copilot added Haiku 5.5 on the same day.

Why it matters Site chatbots, product summaries, spam checks and search tagging just got about ten times cheaper. That makes AI features realistic for small shops and small budgets.

My take: this is the model I’d test first for boring, high-volume jobs. Keep the bigger models for hard coding work.

Read the full story on Anthropic

Tensorlake npm package hit by a worm that wipes you if you revoke

The npm package tensorlake 0.5.144 was published with credential-stealing malware on 8 October. StepSecurity says it steals GitHub and npm tokens, cloud keys, SSH keys, .env files and AI tool configs. It spreads by republishing the victim’s own npm packages.

It also installs a “gh-token-monitor” service. That service checks the stolen GitHub token every 60 seconds. If you revoke the token first, it deletes your home folder. It also plants .claude and .vscode files in your repos so it runs again later.

Why it matters Order matters here. Pin to 0.5.143 and clear node_modules. Then remove the monitor service before you revoke the GitHub token, and only then rotate everything else. If you can’t be sure the machine is clean, reinstall it.

My tip: set ignore-scripts=true in your .npmrc. It blocks install hooks like this one.

Read the full story on StepSecurity

WooCommerce 11.2.0 is out with security fixes

WooCommerce 11.2.0 came out on 7 October. It includes security fixes and a database update. The CSV importer can now match existing products by GTIN, UPC, EAN or ISBN, and the Checkout block can take date fields.

There are a few breaking changes. Download links now have stricter checks, so some rare custom or imported links may stop working. Shop managers can only edit users in roles that a filter allows. Cc and Bcc are gone from three account emails.

Why it matters WooCommerce recommends every store updates. If you use PublishPress Future, update it to 4.10.4 first, because older versions can cause a fatal error.

My tip: take a backup, update on a staging copy, then test one digital download.

Read the full story on WooCommerce Developer

WordPress MCP Adapter is now an official plugin on WordPress.org

The WordPress MCP Adapter is now in the official plugin directory as version 0.70. Before this, it only shipped on GitHub, where it had more than 40,000 installs. WordPress calls it a canonical plugin.

MCP is the protocol AI tools use to talk to other software. The adapter lets AI agents work with your site, such as publishing posts. It uses the Abilities API to control what each agent can do.

Why it matters This is now the official way to connect Claude, ChatGPT and other agents to WordPress. Give agents the smallest set of abilities they need, and use a separate user account for them.

Read the full story on Search Engine Journal

Google’s September 2026 spam update has finished

Google’s September 2026 spam update finished rolling out on 8 October. It started on 24 September and took about 14 days. Recent spam updates took about two days. It is global, covers all languages and does not target link spam.

Search Engine Roundtable saw ranking swings on 25 to 27 September, 30 September and 4 to 6 October. Google says recovery can take months.

Why it matters Now you can check your traffic against a closed window. If you dropped between 24 September and 8 October, review your site against Google’s spam policies. Look hardest at thin pages and mass-made content.

I wrote about SEO fixes you can start this week if you need a place to begin.

Read the full story on Search Engine Roundtable

iOS 27 Safari engine blocks some ad tech domains

iOS 27 blocks some ad tech traffic inside WebKit, the engine every iPhone browser uses. That means Chrome on iPhone is affected too. AppleInsider reports that The Trade Desk was caught by the block, and that the block is reportedly lifted in the iOS 27.2 beta.

According to AdExchanger, as cited by AppleInsider, Apple is going after data brokers and “post-cookie” identity domains. Google’s ad bids are reportedly going through as normal. Apple has not commented.

Why it matters If your site runs ads, check your iPhone ad revenue and fill rate this month. Some ad setups may also break on iOS, so test your pages on an iPhone.

Read the full story on AppleInsider

GitHub Copilot can now run its commands in a local sandbox

GitHub made local sandboxing for Copilot generally available on 7 October. Commands that Copilot runs now stay inside a locked-down space on your own computer. It works in Copilot CLI, the Copilot app and VS Code agent sessions, at no extra cost.

You can limit which files commands can read or change, the network, and access to your Git and GitHub credentials. It works on Windows, macOS and Linux. Companies can force it on for all developers.

Why it matters AI agents now run real commands on machines that hold site passwords and keys. A sandbox limits the damage when an agent, or a bad package like today’s npm worm, does something silly.

Read the full story on GitHub

Google opens its SynthID Detector to everyone

Google opened the SynthID Detector to the public at synthid.com on 7 October. You upload an image, video or audio file, and it checks for SynthID watermarks. It finds watermarks from Google and partner tools, including OpenAI and NVIDIA. Apple is “coming soon”.

It is available worldwide in English. Google says it is “not a general AI detector”. No watermark does not prove a file is human-made.

Why it matters Publishers and shops can now check where an image came from before they use it. It is handy for user reviews and supplier photos.

Read the full story on Google

Amazon replaces Fire tablets with Alexa Tablets

Amazon announced a new tablet range called Alexa Tablets on 8 October. The Alexa Tablet 12 Pro costs US$500 with 8GB of RAM and 128GB of storage. It has a 120Hz screen and Wi-Fi 6E. The Alexa Tablet 11 starts at US$330 and the Alexa Tablet 8 at US$230.

All of them run Alexa+ and come with Google Play already installed. That is a big change from Fire tablets. They arrive on 14 October in the US, Canada and Mexico, and 19 October in parts of Europe.

Why it matters Google Play means real Android apps at last, including Chrome. Amazon has not named an Australian date yet.

Read the full story on Engadget