On September 2, 2026, WP Tavern published episode 232 of its Jukebox podcast, a conversation with Aaron D Campbell, who spent years running WordPress’s own Security Team before moving through hosting security at GoDaddy and Newfold and landing as VP Product at Monarx, a malware detection and remediation vendor for web hosts. Let’s walk through what he had to say together!
How fast is exploitation moving now?
It’s a fitting follow-up to a story we already covered here: wp2shell forced an urgent core update back on July 17, 2026, after the flaw was found under active attack. What we didn’t have at the time was a number for how fast attackers actually moved once that patch went public, and that’s exactly the gap Campbell’s interview fills.
Campbell watches exploitation from the host side at Monarx, and by his own account on the podcast, the timeline has compressed to almost nothing. “Once we released the patch, and everything was out there, the spike of exploitation that we as Monarx saw, like monitoring stuff happened within 30 minutes,” he said. “Honestly, even a little bit faster than that.” For what he calls the more major vulnerabilities generally, he puts the discovery-to-exploitation window at about five hours. Those are Monarx’s own monitoring numbers on its own footprint, not an independently published industry study, so they describe what one host-security vendor sees rather than a rule for every WordPress site.
Elsewhere in the conversation, Campbell mentioned a single exploitation report that ran eleven pages once he printed it out, one illustration of how many steps modern attack chains now stitch together. In his own framing, the fight has shifted from a battle of ingenuity, where a human attacker needed real skill to chain several flaws, to a battle of raw computing power, where an AI system can search for that same chain far faster than any person.
What did WordPress.org build to buy defenders time?
WordPress.org’s answer arrived three months earlier, on June 5, 2026, when WordPress.org announced Protect the Shire in an official blog post signed by Matt Mullenweg.
The mechanism is a delay, not a wall: once a plugin or theme update is submitted, the file itself still goes live on WordPress.org right away, but the update notification that would normally appear in a site’s dashboard is held back for up to 24 hours. That window exists so an AI-assisted reviewer, a tool WordPress.org calls Gandalf, can scan the change alongside the existing human review before it reaches live sites, rather than after. The initiative covers more than 78,000 plugins and themes, protecting a repository with over 400 million cumulative installs and, at its busiest, more than 3,000 commits a day. As the announcement put it, “Freedom and security are not zero-sum.”
On the podcast, Campbell described the delay as “something in the region of six hours,” a rounder, looser number than the 24 hours WordPress.org actually published; the official figure is the one worth keeping in mind, not the one said out loud in conversation. Protect the Shire is also WordPress’s second AI-shaped addition to its core infrastructure this year, after the three building blocks that made the software agentic back in May, though this time the AI is working defense, not new features.
Our take
None of this means WordPress is uniquely under siege. It means one of the internet’s largest software ecosystems is racing to close the same gap every platform now faces: the time between a flaw becoming public and an AI-driven attacker finding it. Protect the Shire buys the review process hours it didn’t have before, but it doesn’t replace what happens on your own site.
Campbell’s own advice, closing out the podcast, stays refreshingly ordinary: turn on automatic updates wherever a plugin or theme offers them, pick a host that takes security seriously rather than the cheapest one available, and check your own credentials periodically against a service like Have I Been Pwned. Turning on automatic updates is THE single change Campbell keeps coming back to, well ahead of anything WordPress.org’s own defenses can do on your behalf. If you already went through the two-minute version-check habit we walked through for Elementor Pro’s CVE-2026-32475, the same habit applies here while the rest of the ecosystem catches up to AI-accelerated attackers.
Photos: Towfiqu Barbhuiya/Pexels, Vanessa Garcia/Pexels. Screenshots: WP Tavern, WordPress.org.
