A thin week on release notes and a thick one on patching. Here is what I would act on.
PHP: update it, even though WordPress did not
On 21 October WordPress.org published a notice about a critical PHP security release. PHP fixed two critical vulnerabilities, and WordPress itself needs no update, because the problem sits underneath it. Any server running PHP applications is in scope, and that includes Magento stores. The notice says to update PHP as soon as possible, to confirm with your host what they have already rolled out, and to treat anything before PHP 8.2 as unsupported, since the PHP project no longer ships security fixes for it. For a self-managed server you cannot fix quickly, it quotes the UK NCSC advice to take it offline. It names no CVE numbers and does not describe the flaws, so I will not guess at them. The practical side is in Thursday's PHP piece.
Magento: nothing new, one loose end
There has been no new Adobe bulletin since APSB26-153 on 13 October: 11 vulnerabilities, 5 of them critical, Priority 2, no known exploitation. That bulletin also asks you to apply the hotfix for CVE-2026-75650 from the earlier APSB26-146. If your patch plan only mentions 153, check that one too. And keep the two jobs separate. A shop can be current on its Magento patches and still sit on an old PHP, or the other way round. Before you bump PHP, check which versions your Magento release supports, and do it on staging first.
Supabase: a quiet changelog and a loud date
The latest changelog entry is still 14 October, OpenTelemetry traces and metrics in the .NET SDK. Nothing since. The date to remember is 10 November, when Supabase disables an outdated subset of TLS 1.2 ciphers on project HTTP APIs. That is eighteen days from today. Anything that calls your Supabase project from an old runtime or a forgotten script should be tested now, from the oldest client you have.
WordPress 7.2 Beta 1
Beta 1 landed on 20 October, with the final release scheduled for 8 December. Two items caught my eye for anyone building on WordPress: a new Secrets API for storing credentials, and client-side media processing, which resizes and compresses images in the browser before upload. The team says not to run the beta on live sites, and I agree. If you maintain plugins or a theme, put a staging copy on it this month rather than finding out in December.
Nuxt
Nothing new. Nuxt 4.6 from 5 October is still the latest release, and the blog has had no post since. If you are planning work on Vue and Nuxt, that is a settled platform to plan against.
What went up here recently
Last Friday was the Magento APSB26-153 and Supabase TLS round-up. This morning there is a piece on AI for a small business in Hull and East Yorkshire.
That is the round-up. If you want a second opinion on a patch plan, a PHP upgrade or a Supabase setup, get in touch.