WordPress is essentially internet infrastructure. It’s widely used, generally stable, and doesn’t tend to generate many splashy headlines as a result.
Technology
The messy WordPress drama, explained
/cdn.vox-cdn.com/uploads/chorus_asset/file/25646942/matt_mullenweg_wordcamp_eu.png?ssl=1 "The messy WordPress drama, explained")
But over the last week, the WordPress community has swept up into a battle over the ethos of the platform. Last week, WordPress cofounder Matt Mullenweg came out with a harsh attack on WP Engine, a major WordPress hosting provider, calling the company a “cancer” to the community. The statement has cracked open a public debate surrounding how profit-driven companies can and can’t use open-source software — and if they’re obligated to contribute something to the projects they use in return.
The conflict has escalated in the days since with a barrage of legal threats and has left swaths of website operators caught in the crossfire of a conflict beyond their control. WP Engine customers were cut off from accessing WordPress.org’s servers, preventing them from easily updating or installing plugins and themes. And while they’ve been granted a temporary reprieve, WP Engine is now facing a deadline to resolve the conflict or again have their customers’ access fall apart once again.
WP Engine is a third-party hosting company that uses the free, open-source WordPress software to create and sell its own prepackaged WordPress hosting service. Founded in 2010, WP Engine has grown to become a rival to WordPress.com, with more than 200,000 websites using the service to power their online presence.
“Silver Lake doesn’t give a dang about your open source ideals, it just wants return on capital.”
Mullenweg leads two different WordPresses. There’s WordPress.org, the open source project that develops the backbone of the WordPress publishing platform, and then there’s WordPress.com, a company that sells a hosted version of the open-source WordPress software — just like WP Engine. Mullenweg runs Automattic, which owns WordPress.com. Data suggests that around 43 percent of all websites use WordPress, but it’s not clear how many are hosted by WordPress.com or another party.
Along with selling plans on WordPress.com, Automattic contributes a lot of development effort to the open source project, which itself relies on donations and community contributions to run. According to Mullenweg, the team contributes 3,988 hours per week. The company may not have to pay to use WordPress, but it certainly pays to develop and improve it.
WP Engine operates a bit differently. It says it focuses on investing in the community through sponsorships and encouraging the adoption of the platform. The hosting platform was acquired by the private equity firm Silver Lake in 2018, and Mullenweg views it as a business that profits off of open-source code without giving anything back.
That frustration came to a head last week when Mullenweg took the stage at WordCamp — a WP Engine-sponsored WordPress conference — and took direct aim at WP Engine. “The company is controlled by Silver Lake, a private equity firm with $102 million in assets under management,” Mullenweg said. “Silver Lake doesn’t give a dang about your open source ideals — it just wants return on capital. So, it’s at this point I ask everyone in the WordPress community to go vote with your wallet. Who are you going to give your money to: someone who is going to nourish the ecosystem or someone who is going to frack every bit of value out of it until it withers?”
Mullenweg followed up this statement with a September 21st blog post, where he lambasted WP Engine for contributing just 40 hours per week to the WordPress.org open source project. “WP Engine is setting a poor standard that others may look at and think is ok to replicate. We must set a higher standard to ensure WordPress is here for the next 100 years,” Mullenweg wrote in the blog. He ripped into WP Engine even more, saying it’s “strip-mining the WordPress ecosystem” and giving users a “crappier experience so they can make more money.”
Mullenweg isn’t just defending the ethos of open source — he’s also defending his competing WordPress provider
Mullenweg doesn’t appear to be wrong about WP Engine’s contributions. But WP Engine is ultimately abiding by the rules of WordPress’ open-source license: it’s generally free to use, and WP Engine doesn’t have to give back to the WordPress community just because it’s banking off the open-source code. Of course, it’d be nice if WP Engine did, but nothing requires that it do so.
Complicating this further: Mullenweg isn’t just defending the ethos of open source — he’s also defending his competing WordPress provider. In his blog post, he claims WP Engine is “profiting off of the confusion” caused by the company’s branding. Mullenweg alleges that WP Engine is promising to give customers WordPress but that the company is actually offering a distilled version of the service. He goes on to say WP Engine will need a commercial license for the “unauthorized” use of the WordPress trademark, which is controlled by the WordPress Foundation and later sent a cease and desist letter in an attempt to make the company pay up.
WP Engine isn’t staying silent. It sent a cease and desist letter that tells a very different story of what has been going on behind the scenes. In its letter, WP Engine claims Automattic demanded a “very large sum of money” days before Mullenweg’s keynote at the September 20th WordCamp convention — and if the company didn’t receive it, Mullenweg allegedly threatened to carry out a “scorched earth nuclear approach” toward WP Engine.
WP Engine alleges Mullenweg harassed the company through text messages and calls, with one screenshotted text saying: “If I’m going to make the case to the WP community about why we’re banning WPE I need to do it in my talk tomorrow.” The texts, which Mullenweg confirmed he sent in an interview with Twitch streamer ThePrimeagen, say he prepared several presentation slides for his WordCamp talk, with the working title “How Private Equity can Hollow out and Destroy Open Source Communities, a Story in 4 Parts.”
After WP Engine refused to pay WordPress, the company alleges Mullenweg followed through on his threats. “Mr. Mullenweg’s covert demand that WP Engine hand over tens of millions to his for-profit company Automattic, while publicly masquerading as an altruistic protector of the WordPress community, is disgraceful,” WP Engine’s letter states. “WP Engine will not accede to these unconscionable demands which not only harm WP Engine and its employees, but also threaten the entire WordPress community.”
WordPress.org has now made it clear that it’s going after WP Engine for not only failing to give back to the WordPress project but also for its alleged misuse of the WordPress trademark. Mullenweg now says Automattic has given WP Engine two ways to “pay their fair share”: either by paying a licensing fee or making contributions to the open source WordPress project. “This isn’t a money grab: it’s an expectation that any business making hundreds of millions of dollars off of an open source project ought to give back, and if they don’t, then they can’t use its trademarks,” Mullenweg said.
The WordPress Foundation — the charitable organization that backs the open source WordPress project — is led by Mullenweg and other lesser-known board members who aren’t displayed on its website. It seems the WordPress Foundation has made some tweaks to its trademark guidelines in recent days. As of September 19th, the policy said you are “free” to use the WP abbreviation in “any way you see fit.” But now WordPress has deleted that language, replacing it with a line that says not to use WP “in a way that confuses people. For example, many people think WP Engine is ‘WordPress Engine.’” The updated policy also explicitly states: “If you would like to use the WordPress trademark commercially, please contact Automattic, they have the exclusive license.”
WordPress.org banned WP Engine from accessing its servers free over their “legal claims and litigation” — a move that has made it more difficult for customers to use WP Engine. However, Mullenweg decided to temporarily remove the block just two days later. He’s given WP Engine until October 1st to create their own mirror or resolve the conflict. “Why should WordPress.org provide these services to WP Engine for free, given their attacks on us?” Mullenweg wrote. WP Engine says it only sent a cease and desist order to WordPress and has not yet filed a lawsuit.
When asked about the ban on WP Engine, Automattic spokesperson Megan Fox said in a statement to The Verge that “trademark violations have resulted in the company being blocked from some WordPress resources.” WP Engine pointed The Verge to its statements on X when reached for comment.
The fight has garnered a mix of reactions. On one side, people think WP Engine is in the wrong, with some saying the company should contribute more to the open source project and that its use of “WP” is misleading. On the other, some WordPress community members are calling on Mullenweg to step down and accuse of him abusing his power over WordPress.org and WordPress.com. Others believe the situation could result in a fork of WordPress and brought up concerns about whether WordPress will take action against other companies using the “WP” abbreviation or trademark.
But in a dispute that’s meant to clarify what is and isn’t WordPress, Mullenweg risks blurring the lines even more. WordPress.org and WordPress.com both have a point — but it looks an awful lot like they’re working together to make it.
Continue Reading
Ring’s partnership with Flock is sparking renewed online backlash this week, with influencers calling for people to smash their Ring cameras and claiming the company is part of the surveillance state amid heightened concerns over ICE actions.
Flock is an AI-powered surveillance camera company that has reportedly allowed government agencies — including ICE — to access data from its nationwide camera network. Amazon-owned home security company Ring announced a partnership with Flock last year as part of its new Community Requests tool. This allows local law enforcement agencies to request footage from nearby Ring users when investigating an active case.
“Ring has no partnership with ICE … and does not share video with them.”
According to reporting from Futurism, activists are pushing a grassroots campaign across social media, including TikTok and Bluesky, telling Ring users to get rid of their cameras to prevent footage from being used by ICE. However, Ring spokesperson Yassi Yarger told The Verge in an email that “Ring has no partnership with ICE, does not give ICE videos, feeds, or back-end access, and does not share video with them.”
Yarger also said that the Flock integration in question, which was announced last October, is not yet live. Meaning Flock does not have access to Community Requests.
“As we explore the integration, we will ensure the feature is built for the use of local public safety agencies only — which is what the program is designed for,” she said. According to Ring’s support site, local agencies are limited to city and county organizations.
Still, once footage is in the hands of local authorities, it’s out of Ring’s control. Ring founder Jamie Siminoff has told The Verge that he believes widespread cameras can prevent crime. But once deployed, the potential for such a large-scale local surveillance system to be used for other purposes is very real.
Since returning to the company last year, Siminoff has leaned into his belief that more cameras lead to safer communities, launching Community Requests last September.
This is essentially a rebrand of Ring’s controversial Request for Assistance feature, which was discontinued in 2024. Only, instead of direct partnerships with law enforcement, Community Requests works through integrations with “third-party evidence management platforms,” such as Flock and Axon, a Taser and body-cam company.
Any local agency partnered with either company can request users’ footage through the Ring’s apps. According to Yarger, currently, only the Axon partnership is live.
According to Ring, Community Requests sends a request from the local agency to both the Ring Neighbors app and the Ring app’s Community Feed. The request appears to all users in the area of an active investigation, and a user can choose to share footage or ignore the request. Ring says no one will be notified if you ignore a request.
How to disable Community Requests and enable E2E
If you don’t want to participate in Community Requests, you can disable it in the Ring or Neighbors app. Go to the app’s settings page, find the Neighbors Settings, then scroll down to Neighborhood Settings, click Feed Settings, uncheck Community Requests, and click Apply.
However, Ring — like many security camera companies — may provide footage to law enforcement without a warrant in what it deems an emergency.
To prevent anyone from accessing your Ring footage, you can enable end-to-end encryption (E2E) in the Ring app.
While your footage is still stored in Ring’s cloud, with E2E turned on, only the mobile device you set up the camera with can view the video; it cannot be accessed by Ring or used for Community Requests.
Enabling E2E means you lose several features, including person detection, rich notifications that show a snapshot of activity, and Ring’s new AI-powered descriptions, all of which rely on the cloud.
While most cloud-based security cameras encrypt footage in transit and at rest, they need to access it in the cloud to analyze it and enable those features.
Alternatives to cloud-dependent cameras
If you want to avoid cloud-dependent cameras entirely, there are several other options for keeping your camera footage private and secure.
As mentioned, Ring cameras use the cloud to process footage for features like person detection; however, some security cameras can process video locally and fully encrypt it before sending it to the cloud. Generally, this requires a hub to process the footage.
If you are an iPhone user, Apple’s HomeKit Secure Video service is fully E2E encrypted. Video analysis is done locally on a home hub, such as a HomePod or Apple TV, and stored in your iCloud account. It requires compatible cameras, including models from Eve, Aqara, and Eufy.
Anker-owned Eufy is another company that offers local storage and video processing for its wide selection of cameras and video doorbells. The company had some serious security breaches involving the cloud in 2022, but its newer HomeBase hardware can run locally.
TP-Link’s Tapo, Aqara, and Reolink recently launched local hubs for storage and processing of footage from their cameras, and these companies also offer cameras and video doorbells with onboard local processing and local storage via microSD cards.
The new Matter standard now supports security cameras, which could open more options for local, secure storage and processing of camera footage.
Ultimately, any camera connected to the internet comes with the risk that it could be accessed by someone other than you, no matter what the company says. So it remains important to think carefully before adding any type of surveillance to your home or your neighborhood.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
Online shopping feels familiar and fast, but a hidden threat continues to operate behind the scenes.
Researchers are tracking a long-running web skimming campaign that targets businesses connected to major payment networks. Web skimming is a technique where criminals secretly add malicious code to checkout pages so they can steal payment details as shoppers type them in.
These attacks work quietly inside the browser and often leave no obvious signs. Most victims only discover the problem after unauthorized charges appear on their statements.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
WHATSAPP WEB MALWARE SPREADS BANKING TROJAN AUTOMATICALLY
Web skimming attacks hide inside checkout pages and steal card details as shoppers type them in. (Kurt “CyberGuy” Knutsson)
What Magecart is and why it matters
Magecart is the name researchers use for groups that specialize in web-skimming attacks. These attacks focus on online stores where shoppers enter payment details during checkout. Instead of hacking banks or card networks directly, attackers slip malicious code into a store’s checkout page. That code is written in JavaScript, which is a common type of website code used to make pages interactive. Legitimate sites use it for things like forms, buttons and payment processing.
In Magecart attacks, criminals abuse that same code to secretly copy card numbers, expiration dates, security codes and billing details as shoppers type them in. The checkout still works, and the purchase goes through, so there is no obvious warning sign. Magecart originally described attacks against Magento-based online stores. Today, the term applies to web-skimming campaigns across many e-commerce platforms and payment systems.
Which payment providers are being targeted?
Researchers say this campaign targets merchants tied to several major payment networks, including:
- American Express
- Diners Club
- Discover, a subsidiary of Capital One
- JCB Co., Ltd.
- Mastercard
- UnionPay
Large enterprises that rely on these payment providers face a higher risk due to complex websites and third-party integrations.
700CREDIT DATA BREACH EXPOSES SSNS OF 5.8M CONSUMERS
Criminals use hidden code to copy payment data while the purchase still goes through normally. (Kurt “CyberGuy” Knutsson)
How attackers slip skimmers into checkout pages
Attackers usually enter through weak points that are easy to overlook. Common entry paths include vulnerable third-party scripts, outdated plugins and unpatched content management systems. Once inside, they inject JavaScript directly into the checkout flow. The skimmer monitors form fields tied to card data and personal details, then quietly sends that information to attacker-controlled servers.
Why web skimming attacks are hard to detect
To avoid detection, the malicious JavaScript is heavily obfuscated. Some versions can remove themselves when they detect an admin session, which makes inspections appear clean. Researchers also found the campaign uses bulletproof hosting. These hosting providers ignore abuse reports and takedown requests, giving attackers a stable environment to operate. Because web skimmers run inside the browser, they can bypass many server-side fraud controls used by merchants and payment providers.
Who Magecart web skimming attacks affect most
Magecart campaigns impact three groups at the same time:
- Shoppers who unknowingly give up card data
- Merchants whose checkout pages are compromised
- Payment providers that detect fraud after the damage is done
This shared exposure makes detection slower and response more difficult.
NEW MALWARE CAN READ YOUR CHATS AND STEAL YOUR MONEY
Simple protections like virtual cards and transaction alerts can limit damage and expose fraud faster. (Kurt “CyberGuy” Knutsson)
How to stay safe as a shopper
While shoppers cannot fix compromised checkout pages, a few smart habits can reduce exposure, limit how stolen data is used, and help catch fraud faster.
1) Use virtual or single-use cards
Virtual and single-use cards are digital card numbers that link to your real credit or debit account without exposing the actual number. They work like a normal card at checkout, but add an extra layer of protection. Most people already have access to them through services they use every day, including:
Major banks and credit card issuers that offer virtual card numbers inside their apps
Mobile wallet apps like Apple Pay and Google Pay generate temporary card numbers for online purchases, keeping your real card number hidden.
Some payment apps and browser tools that create one-time or merchant-locked card numbers
A single-use card typically works for one purchase or expires shortly after use. A virtual card can stay active for one store and be paused or deleted later. If a web skimming attack captures one of these numbers, attackers usually cannot reuse it elsewhere or run up repeat charges, which limits financial damage and makes fraud easier to stop.
2) Turn on transaction alerts
Transaction alerts notify you the moment your card is used, even for small purchases. If web skimming leads to fraud, these alerts can expose unauthorized charges quickly and give you a chance to freeze the card before losses grow. For example, a $2 test charge on your card can signal fraud before larger purchases appear.
3) Lock down financial accounts
Use strong, unique passwords for banking and card portals to reduce the risk of account takeover. A password manager helps generate and store them securely.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
4) Install strong antivirus software
Strong antivirus software can block connections to malicious domains used to collect skimmed data and warn you about unsafe websites.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
5) Use a data removal service
Data removal services can reduce how much personal information is exposed online, making it harder for criminals to pair stolen card data with full identity details.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
6) Watch for unexpected card activity
Review statements regularly, even for small charges, since attackers often test stolen cards with low-value transactions.
Kurt’s key takeaways
Magecart web skimming shows how attackers can exploit trusted checkout pages without disrupting the shopping experience. While consumers cannot fix compromised sites, simple safeguards can reduce risk and help catch fraud early. Online payments rely on trust, but this campaign shows why that trust should always be paired with caution.
Does knowing how web skimming works make you rethink how safe online checkout really is? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Around 800 artists, writers, actors, and musicians signed on to a new campaign against what they call “theft at a grand scale” by AI companies. The signatories of the campaign — called “Stealing Isn’t Innovation” — include authors George Saunders and Jodi Picoult, actors Cate Blanchett and Scarlett Johansson, and musicians like the band R.E.M., Billy Corgan, and The Roots.
“Driven by fierce competition for leadership in the new GenAI technology, profit-hungry technology companies, including those among the richest in the world as well as private equity-backed ventures, have copied a massive amount of creative content online without authorization or payment to those who created it,” a press release reads. “This illegal intellectual property grab fosters an information ecosystem dominated by misinformation, deepfakes, and a vapid artificial avalanche of low-quality materials [‘AI slop’], risking AI model collapse and directly threatening America’s AI superiority and international competitiveness.”
The advocacy effort is from the Human Artistry Campaign, a group of organizations including the Recording Industry Association of America (RIAA), professional sports players unions, and performers unions like SAG-AFTRA. The Stealing Isn’t Innovation campaign messages will appear in full-page ads in news outlets and on social media. Specifically, the campaign calls for licensing agreements and “a healthy enforcement environment,” along with the right for artists to opt out of their work being used to train generative AI.
On the federal level, President Donald Trump and his tech industry allies have been attempting to control how states regulate AI and punish those that try. At the industry level, tech companies and rights owners who were once on opposing sides are increasingly cutting licensing deals that allow AI companies to use protected work — licensing content appears to be a solution both parties can live with, at least for now. Major record labels, for example, have now partnered with AI music startups to provide their catalogues for AI remixing and model training. Digital publishers, some of which have sued AI companies training on their work, have backed a licensing standard that outlets can use to block their content from surfacing in AI search results. Some outlets have signed individual deals with tech companies that allow AI chatbots to surface news content (Disclosure: Vox Media, The Verge’s parent company, has a licensing deal with OpenAI.)
San Francisco, CA4 minutes ago
Clock runs out: San Francisco Centre to close Monday
Dallas, TX10 minutes ago
Young hockey star chases 2026 Olympic dreams
Miami, FL16 minutes ago
Miami-Dade Sheriff releases bodycam and surveillance video of deadly Walmart shooting involving alleged shoplifter
Boston, MA22 minutes ago
Bruins strike early, hold off Golden Knights 4-3 for 9th win in 11 games
Denver, CO28 minutes ago
Broncos DC Vance Joseph on offenses attacking with TEs: ‘Been that way for two years’
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Virginia1 year ago
99th annual Pony Swim held in Virginia
Indiana1 year ago
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
Politics8 hours ago
White House explains bruise on Trump’s hand
World9 hours ago
NATO allies unaware of Greenland deal details so far, says Spanish FM Albares
News10 hours ago
Magistrate judge rejects charges against Don Lemon over anti-ICE protest in Minnesota church
Videos15 hours ago
Davos: GOP senator describes the mood during Trump’s speech
Politics20 hours ago
Judge rules NYC’s lone Republican congressional district unconstitutional, orders redraw
-
Sports4 days agoMiami’s Carson Beck turns heads with stunning admission about attending classes as college athlete
-
Illinois15 hours agoIllinois school closings tomorrow: How to check if your school is closed due to extreme cold
-
Detroit, MI1 week agoSchool Closings: List of closures across metro Detroit
-
Pittsburg, PA4 days agoSean McDermott Should Be Steelers Next Head Coach
-
Lifestyle1 week agoJulio Iglesias accused of sexual assault as Spanish prosecutors study the allegations
-
Education1 week ago
How a Syrian Hiking Club Is Rediscovering the Country
-
Sports3 days agoMiami star throws punch at Indiana player after national championship loss
-
Lifestyle4 days agoNick Fuentes & Andrew Tate Party to Kanye’s Banned ‘Heil Hitler’