Three days after a patch shipped, a critical WordPress flaw is still causing damage at scale, Google is confirming just how far search has shifted toward "zero-click," and AI-driven browsers are moving from early prototypes to mass adoption. Here is the web news for September 27, 2026, and what it concretely means for a website run out of Tunisia.
Critical WordPress flaw (CVE-2026-87902) now affects over 350,000 sites
On September 24 we covered the emergency release of WordPress 7.1.2, which fixes a path-traversal flaw (CVE-2026-87902, CVSS score 9.2) that lets an unauthenticated attacker execute arbitrary code through the pagename parameter. Three days later, the situation has worsened: according to Shadowserver data reported by Tech Times, more than 350,000 sites remain unpatched today, even though the first exploitation attempts began less than four hours after the patch shipped (source: Tech Times).
The attack unfolds in three stages documented by Patchstack: scanning for vulnerable sites, confirming code execution through the pearcmd.php script, then dropping persistent webshells with names such as wp-pear-rce-flag.php. Attack volume jumped tenfold on September 23, once an automated scanning template started circulating publicly (source: Patchstack). The flaw affects versions 4.7.0 through 7.1.1 — nearly a decade of releases — and is fixed in versions 7.1.2, 7.0.6, 6.9.9 and 6.8.10.
Google Search: AI Mode now ends without a click 93% of the time
Google's September 2026 webmaster report confirms the accelerating shift toward AI-driven results, with carousel-style cards for developing stories and answers now powered by Gemini 3.7 Flash (source: Search Engine Roundtable). Semrush data cited this month puts a precise number on the traffic impact: 93% of searches conducted in AI Mode end without a single click to an external site, compared with 83% for standard AI Overviews and 60% for a traditional Google search.
A smaller but notable technical change for SEO teams: Google now applies HTML unescaping to JSON-LD structured data in a single pass, and rolled out new tracking parameters on "google.com/goto" to shield its results from third-party tools such as SerpAPI. For any site that depends on organic traffic, these numbers confirm a trend already under way: ranking well is no longer enough if content isn't structured to be quoted directly inside an AI answer rather than clicked.
Agentic AI browsers scale up: Atlas, Comet and Claude for Chrome
The agentic browser landscape we covered on September 24 has settled into three categories: standalone browsers such as ChatGPT Atlas or Perplexity Comet (free since October 2025), built-in extensions such as Claude for Chrome or Gemini's "auto browse" mode, and cloud-based agents such as ChatGPT Agent (source: SearchViu). Adoption is climbing fast: Claude for Chrome grew from roughly 40,000 to more than 10 million installs between December 2025 and June 2026.
The most practical point for any site owner: these agents browse with the same technical fingerprint as a human visitor — residential IP, identical Chrome user agent, authenticated session — which makes agentic traffic very hard to isolate in standard analytics. With Chrome holding around 65% browser market share, whatever AI features Google ships natively is set to generate the largest share of this agentic traffic — reinforcing the point made in our piece on the WebMCP standard: clear, well-structured user journeys matter as much for agents as for human eyes.
What to remember today
| Topic | Key figure | Impact for your site |
|---|---|---|
| WordPress flaw CVE-2026-87902 | 350,000+ sites unpatched, active webshells | Update immediately to 7.1.2 or a patched branch |
| Google AI Mode search | 93% of searches end with zero clicks (Semrush) | Structure content to be quoted, not just ranked |
| Agentic browsers | 10M+ installs for Claude for Chrome (June 2026) | Keep forms and journeys clear for agents and humans |
Three concrete actions to take now
- Update WordPress without delay to version 7.1.2 (or 7.0.6 / 6.9.9 / 6.8.10 depending on your branch), check your logs for suspicious sequences in the
pagenameparameter, and disableregister_argc_argvin your PHP configuration if you don't use it. - Audit your key pages to make sure they answer the reader's question directly within the first lines and expose clean structured data — that is the type of content most likely to be quoted in an AI-generated answer, even without a click.
- Review your conversion journeys (quote requests, orders, bookings) so they stay usable both by a human visitor and by an AI browsing agent filling in a form on someone's behalf.
See our September 24 coverage of the critical WordPress flaw and AI browsers, and the following day's piece on Chrome and Firefox's new release cadence and the WebMCP standard. If your site runs on WordPress, our page on WordPress site management and security in Tunisia details our maintenance approach.
Is your WordPress site up to date and well ranked?
We run a free security and visibility audit for your site.