Three things worth your attention this week, one of which needs action today if you or a client is still running WordPress.

WordPress 7.1.2: patch it now

WordPress shipped 7.1.2 on Tuesday to fix CVE-2026-87902, an unauthenticated path traversal bug that researchers turned into working remote code execution within hours of disclosure. No login needed, no plugin required on some configurations, just a crafted request against core. If you manage WordPress sites for clients, or even one for yourself, this is a today job, not a this-week job. Patchstack and Help Net Security both have decent writeups if you want the technical detail. I don't build much raw WordPress here at HD, but a good chunk of the sites I get called in to fix after a migration went wrong started life on WordPress, so I'm watching this one closely. If plain WordPress security and hosting is the bit you need help with, that's my colleague Adam's patch, not mine: pwadeveloper.uk covers it properly.

Nuxt 4.5 swaps its build layer

Nuxt 4.5 landed with Vite 8 as the default builder and an Rsbuild-powered Rspack option alongside it, plus experimental SSR streaming. It's the clearest signal yet that the Nuxt team is staging the jump to Nuxt 5 rather than dropping it in one go, which is the right call given how many production sites are sat on 4.x. I've upgraded two client projects this week without touching application code, just the build config, and both came out faster. If you're on Nuxt 3 still, this isn't the release that forces your hand, but it's worth reading the migration notes before your next greenfield build.

Claude for Small Business grows up

Anthropic pushed a big update to Claude for Small Business this month: 43 workflows and 27 app integrations, aimed squarely at the owner-operator who doesn't have a dev team to wire things together for them. Worth a look if you've been treating AI as a chat window and nothing more. Coincidentally, the piece going out on this site later today asks exactly that question from a developer's side, not a marketing one: is Claude actually good for a small business, or is this another round of features nobody outside a demo video will use. I've been building integrations against Claude for the last year and my honest take is in that piece, not this one.

Supabase, in brief

Pipelines moved a new set of destinations into early access this month, Postgres Changes picked up more filter operators so you can subscribe to a narrower slice of a table's changes, and there's now trace propagation from the client through to server logs, which is a useful debugging addition if you've ever tried to work out which browser tab caused a specific database write. None of it is a reason to change anything today, but if you're deep in Supabase day to day it's worth a skim of the changelog.

What went up here this week

Tuesday's piece walked through preparing for a headless migration: the audit work that has to happen before you touch a line of code, not after. If you're new here and want the basics first, what a headless CMS actually is is the place to start, and last week's round-up covered the Magento zero-day if you missed it.

That's the round-up. Questions, or want a second opinion on a migration or a Supabase setup, get in touch.