Sustainable/Open Business

Last month, a critical WordPress vulnerability triggered emergency patching across the web — and reignited a familiar argument: if WordPress keeps having security problems, why not let AI build something new instead?

It’s a reasonable question.

AI has made software dramatically cheaper and faster to create. But somebody still has to understand it, patch it, test it, and keep it running eighteen months from now.

That’s the part of the “AI instead of WordPress” pitch we think is getting overlooked.

On July 17, WordPress shipped an emergency security release for a vulnerability chain now being called wp2shell.

While your site is running, things change. A content editor tweaks a configuration setting. A security vulnerability surfaces in a dependency. A production fix gets applied directly instead of going through the normal release process.

Vibe-coding is all the rage today. Who needs a developer when you can get an AI to develop an application for you? There are scads of application development tools now that promise to create that app you always wanted -- and surprisingly, these often work!

Last December I wrote up 24 specific things we've automated on Drupal, and published them as an Advent Calender -- one little nugget each day.

Call me a radical, but I don't think a handful of billionaires controlling the majority of a country's wealth is a good thing. I don't think the ultra-wealthy need more benefits at the expense of everyone else.

Owning a website in 2025 is not as freeform a thing as it was a couple decades ago. Much like the owner of a store or an amusement park ride has to pay some attention to safety hazards, now site owners can't simply neglect caring for the privacy of their visitors.

It's the end of 2024, and compared to 10 years ago, there's a lot of changes when it comes to privacy.

How do you know if your website is working effectively? What does that even mean?