This is the news from Monday 12 October. Read the latest news
Daily news
Zombify exploit, a dead store tag and Search Console delays
Today in 30 seconds
- Zombify WordPress plugin flaw has public exploit code and no fix
- Expired ecomtrack.io domain turns old store tags into a malware trap
- Chrome and Edge miss lookalike domains built with two letters
- Google Search Console performance data is up to 67 hours late
- Microsoft Decision-1 makes yes or no AI answers almost free
- Nvidia in talks to buy or back open model maker Reflection AI
- Microsoft’s Satya Nadella wants an emergency brake for AI models
- Stack Overflow survey finds developers use AI daily but trust it little
- Apple’s HomeView hub will ship in mid-November, Gurman says
Good morning. The weekend was quiet for launches, but security had a busy shift. A WordPress plugin has no fix, old store tags went rogue, and Search Console fell asleep. Let’s get you sorted.
Zombify WordPress plugin flaw has public exploit code and no fix
The Zombify plugin for WordPress has a CVSS 10 flaw that lets anyone upload a web shell. No login is needed. It affects version 1.7.7 and earlier, and Patchstack says there is no official patch yet.
The flaw is CVE-2026-94503. It became public on 9 October, and exploit code appeared on GitHub on 10 October. That makes attacks much easier for anyone who wants to try.
Why it matters A web shell gives an attacker full control of your site and its files. If you run Zombify, deactivate and delete it today. Bring it back only when a fixed version ships.
Check your plugin list even if you don’t remember installing it. Themes and old developers leave plugins behind. My 10-minute out-of-date check helps here.
Expired ecomtrack.io domain turns old store tags into a malware trap
An analytics startup let its ecomtrack.io domain expire. Attackers registered it again in September 2026. Online stores that still load the old tracking tag now run the attackers’ JavaScript instead.
Visitors get sent to scam sites and online casinos. One route leads to a fake crypto trading site that serves P7 DarkSword, a new version of an iPhone spyware kit. It targets iPhones that are not up to date, and it can steal keychain and crypto wallet data.
Why it matters Every script tag on your site is a door. Remove tags for tools you no longer use, and update your iPhone if you have not done it lately.
I see dead tracking tags on almost every older store I audit. Delete them. They do nothing for you and they can hurt your customers.
Chrome and Edge miss lookalike domains built with two letters
Researchers found that two Unicode letters, ө and ƙ, slip past the lookalike domain checks in Chromium browsers. Fake domains like oƙta.com show in the address bar as normal text instead of a warning code. The trick still worked in Chrome 154.
The team registered 20 lookalike domains to prove it. They also counted about 162,000 lookalike pairs among .com addresses. Gmail showed the fakes as normal text too, while Outlook on the web did not.
Why it matters Phishing links can look exactly like your brand or your bank. Don’t trust the address bar alone. Use a password manager, because it will not fill your login on a fake domain.
Google Search Console performance data is up to 67 hours late
The Performance report in Google Search Console was more than 64 hours behind on Sunday 11 October. Later checks showed 67 hours. It normally updates within a few hours. By Sunday morning US time, the delay was down to 44 hours.
The lag started after the September 2026 spam update finished. Google had not commented when the story was published.
Why it matters If your clicks look flat for the last two days, don’t panic. The data is late, not lost. Wait for it to catch up before you judge any changes.
I would not read this as a sign of a core update. I would just check again on Tuesday.
Microsoft Decision-1 makes yes or no AI answers almost free
Microsoft launched Decision-1, a “decision model” that picks from set answers instead of writing text. It costs US$0.042 per million input tokens, and output is free. It is on Microsoft Foundry now and on Vercel’s AI Gateway.
The first version is built on Alibaba’s Qwen3.5-9B. Microsoft says it will move to its own and OpenAI’s models soon. Microsoft also claims it beats rivals on speed and accuracy, but nobody has checked those numbers yet.
Why it matters Jobs like tagging spam comments or sorting support emails just got very cheap. You no longer need a big model for a simple choice.
I like this trend. Most AI jobs on a small business site are simple choices, and I would rather pay cents than dollars for them.
Nvidia in talks to buy or back open model maker Reflection AI
Nvidia is in early talks to invest more in Reflection AI or buy it, the Financial Times reported on 10 October. Nvidia has already put US$800 million into the startup. A deal could come within weeks, or the talks could fall apart.
Reflection was founded by former DeepMind researchers. It released Beam, its first open-weight model for coding, last week.
Why it matters Open models you can run yourself are a cheaper choice for coding tools. A bigger Nvidia push could mean more of them, and better ones.
Microsoft’s Satya Nadella wants an emergency brake for AI models
Microsoft CEO Satya Nadella posted on Saturday that AI needs new safety controls. He wants the model kept separate from the tools that run its work. He also wants every important action logged, and a person who can stop a model mid-task.
“We must assume a model is compromised and contain it from the start,” he wrote. He called it “an emergency brake”. The post follows a week of stories about AI agents acting on real websites.
Why it matters If you let AI agents touch your site or store, the same rules apply to you. Give them limited access, keep logs, and make sure you can switch them off.
I agree with him on this one. My rule is simple. Give an agent the smallest access that still gets the job done.
Stack Overflow survey finds developers use AI daily but trust it little
Stack Overflow asked 30,903 developers in 169 countries about AI. Nearly a third of daily users spend four hours or more a day with it. But only 7% trust AI output for important work decisions.
About 48% trust it when they can check the answer easily. And 79% say a clear source matters when they decide whether to trust an AI answer.
Why it matters People want sources, and so do AI answer engines. Clear, well-cited pages are what gets you quoted. My guide on how AI search finds your site covers the basics.
Apple’s HomeView hub will ship in mid-November, Gurman says
Apple’s new HomeView smart home hub will ship around mid-November, according to Bloomberg’s Mark Gurman. Apple shows it on 13 October. The new Apple TV 4K and HomePod mini should reach stores on 30 October.
HomeView has a screen and an A18 chip, and you mostly control it with your voice. It comes as a countertop model in four colours and a wall model in two. There will be no App Store for it.
Why it matters If you were about to buy a smart display, wait until after Apple’s event on 13 October.
Quick hits
- No new exploited flaws hit WordPress core, browsers, Windows or macOS in the last 36 hours. CVE Brief
- SendPress Newsletters 1.26.1.20 and earlier has a CVSS 9.3 SQL flaw with no fix. Remove it. Patchstack
- Telegram Desktop has public exploit code for a one-click account takeover. Update to 7.2.9 or later. The Cyber Sec Guru
- Denmark’s CPR register leaked data on 8.8 million numbers through a firm whose admin password was “123456”. The Copenhagen Post
- Anthropic has cut live internet access for all its internal AI tests until its monitoring improves. The Hacker News
- GitHub Copilot for JetBrains lets admins set the default model and stop MCP servers starting on their own. GitHub
- Apple is hiring staff and licensing tech from Huxe, a podcast startup from former NotebookLM developers. TechCrunch
- Apple TV 4K is getting an A19 chip and a Siri Remote that may be easier to find. MacRumors
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Monday 12 October. A newer edition is waiting for you.
Read the latest news → ← Sunday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. Two plugins with no fix and a dead tracking tag are the kind of jobs that slip through the cracks. My site updates service keeps an eye on your plugins and scripts for you. Have a good week.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.