Google's May 2026 Core Update Is Done: A Step-by-Step Recovery Plan
Google's May 2026 core update finished rolling out June 2 after about 12 days — the second of 2026 and heavier than March. Here's an honest recovery plan: how…
KNOWLEDGE BASE
ALL ARTICLES
Technical writing on Claude AI MCP connectors, PHP development, WooCommerce, storage billing systems, reverse engineering, and cybersecurity. 164 articles and counting.
Google's LLM Patent Points to a New SEO Priority: Teaching AI Who Your Business Is
A Google patent — "Data extraction using LLMs" — describes AI building a holistic profile of your business from your website, reviews, directories, and public…
HTTP/2 Bomb: Remote DoS on NGINX, Apache, IIS & Envoy (CVE-2026-49975)
A single attacker on a home connection can exhaust 32 GB of server RAM in under 20 seconds by chaining HPACK compression amplification with HTTP/2 flow-control…
Gravity SMTP WordPress Plugin: 17M Attacks, API Keys Leaking (CVE-2026-4020)
The Gravity SMTP WordPress plugin (≤2.1.4) has been hit with 17 million+ attack attempts — including 4 million in a single day. An unauthenticated info…
CVE-2026-4020: Gravity SMTP Plugin Exposes API Keys
A vulnerability in the Gravity SMTP WordPress plugin is being mass-exploited, with Wordfence blocking over 17 million attempts since May 2026. The flaw lets…
Two Critical NGINX RCE Flaws: CVE-2026-42530 & 42055
F5 released emergency patches for two CVSS 9.2 critical RCE flaws in NGINX — a use-after-free in the HTTP/3 QUIC module (CVE-2026-42530) and a heap buffer…
HTTP/2 Bomb (CVE-2026-49975): One-Connection DoS Attack
A novel denial-of-service exploit discovered by OpenAI Codex lets a single attacker exhaust tens of gigabytes of server memory in under 20 seconds by chaining…
CVE-2026-8206: Kirki WordPress Plugin Privilege Escalation
A critical unauthenticated privilege escalation flaw in the Kirki Customizer Framework WordPress plugin allows attackers to take over any user account —…
CVE-2026-8713: Avada Builder File Deletion RCE
A critical arbitrary file deletion flaw in the Avada Builder plugin lets attackers delete wp-config.php, triggering WordPress install mode and enabling them to…
Google Search Console: New Gen AI Performance Reports
Google launched dedicated Gen AI Performance Reports in Search Console on June 3, 2026 — giving site owners impressions data for AI Overviews, AI Mode, and…
Google Back Button Hijacking: Spam Policy Enforced
Google's back button hijacking spam policy went into enforcement on June 15, 2026. Sites that trap users in navigation loops — including via third-party…
Bing Webmaster Tools: New AI Citation Share Report
Bing Webmaster Tools' AI Performance Report now includes Intent classification, Topic grouping, Citation Share, and a Compare feature — making it the most…