Episode 34 Maciek Palmowski - CourtneyR.dev's 2nd Brain

Episode 34: Maciek Palmowski ![rw-book-cover](https://img.youtube.com/vi/tmn8Ika1-9o/maxresdefault.jpg) 🔗 **Source:** [Episode 34: Maciek Palmowski](https://www.youtube.com/watch?v=tmn8Ika1-9o) > [!note]+ Document Notes > tags: [community-and-code, wordpress-security, ai-assisted-security-research, plugin-ecosystem, cms-interoperability, vibe-coding] > author: Maciek Palmowski > source: Community & Code > reference: https://www.youtube.com/watch?v=tmn8Ika1-9o > date created: 2026-09-22 > > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > # 🏷️ Title: Episode 34: Maciek Palmowski >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Episode 34: Maciek Palmowski (YouTube)](https://www.youtube.com/watch?v=tmn8Ika1-9o) - [Patchstack](https://patchstack.com/) — the guest's employer (captions render it "PatchAC" / "patch stack") - [Statamic](https://statamic.com/) — Laravel-based CMS the guest cites (captions render it "static") - [Wordfence](https://www.wordfence.com/) — mentioned as facing the same AI-report flood (captions: "word fans") ## 📝 Summary - **What happened:** Host Chris Reynolds interviews Maciek Palmowski, growth engineer at Patchstack and co-organizer of CMS Conf, on episode 34 of Community & Code (51:49). They cover his path into tech, why WordPress drew him in, CMS tribalism, the fractured plugin repository, Gutenberg's UX split, AI's effect on security research, and vibe-coded sites. - **Why it matters:** Palmowski says Patchstack's last annual report measured about 5 hours from vulnerability disclosure to exploitation, down from weeks and then days. He says AI now surfaces zero-days, including in WordPress core, that human researchers missed. "Keep WordPress updated" no longer covers the risk window. - **Key stakeholders:** plugin authors, site owners and hosts, security vendors (Patchstack, Wordfence), bug bounty researchers, the WordPress security and release teams, and organizers of cross-CMS events. - **Risks and tradeoffs:** AI-generated bug reports flood triage queues (Patchstack tightened bounty rules and added AI tooling); a React admin rewrite risks repeating Gutenberg's early accessibility regressions; vibe-coded apps built on Lovable/Bolt-style tools ship with databases and payments but no maintenance plan. - **Bottom line:** WordPress's 40%-scale is both its moat and its brake, and the security window has shrunk to hours. Cross-CMS exchange and verification discipline are the two fixes the guest keeps returning to. ## 📖 Main Content - **Career as a bridge role.** Palmowski started on a ZX Spectrum clone at about age 3 (he says 37 years ago), moved through an Amiga 500 and PCs, earned Cisco certifications, then chose generalist work: a developer who can talk to non-technical teams. His title now is growth engineer, the technical person inside Patchstack's marketing/growth team. He says AI cut prototype time to "one day work tops." - **Why WordPress.** He says WordPress documentation and its theme-building approach "clicked" where Joomla, Drupal, and TYPO3 had friction. WordCamps kept him: "came for the code, stayed for the community." Reynolds notes that slogan is a DrupalCon sticker. - **Tribalism across CMSs.** Palmowski describes a PHP UK talk on "Drupalisms" that would fit WordPress if you swapped names and dates. Reynolds reports that at WordCamp US someone (name garbled in captions; unverified) asked Matt Mullenweg how to fight tribalism, and the answer was to invite other communities to WordPress events — Reynolds isn't satisfied with that. - **CMS Conf origin.** After a bilingual Polish WordCamp (edition and year not stated clearly in the captions; unverified), the organizers agreed to run a cross-CMS conference without Foundation support. He says smaller CMSs, including a new Polish one (captions: "MDCMS", unverified), lack venues to present. - **AI lowers the specialist premium.** Because AI lowers the entry barrier to any tool, he argues people should pick the right tool instead of adding "a gazillion of workarounds" to their default CMS. - **Funding and collaboration contrast (host).** Reynolds describes DrupalCon tickets at $800–900 funding the Drupal Association's sponsored development, including Drupal's AI modules, and says the absence of a premium-module market makes Drupal maintainers merge similar modules rather than compete. These are the host's claims, not verified here. - **The fractured repository.** During a month-long Patchstack bug bounty, lifting the 1,000+ installs rule let researchers download the rest of the repo, and reports spiked. He says most plugins don't reach even a few thousand installs and few companies have more than 10 plugins in the repository. He doesn't remember exact numbers. - **Built-in vs. bolted-on.** He cites Statamic shipping forms and custom fields/content modeling in core — features that are large commercial plugins in WordPress (ACF is his example). He calls WordPress "more a framework than a CMS." At his security talks only one attendee ever reported running WordPress with zero plugins. - **UX dissonance.** Both describe the jump from the list screens to the block editor as jarring. Palmowski had to add a publish-webhook control to the block editor sidebar on a headless site because the left-menu option disappears in the editor. He warns an admin rewrite could reintroduce accessibility problems the old admin didn't have. - **Less popular, more agile.** He wishes WordPress were less popular so it could experiment; at 40% share, breaking changes are hard, especially for volunteer release teams. He says WordPress still hasn't decided whether it's for bloggers, agencies, or enterprise, and that 50–70% of users (his guess, no data) don't care what CMS they're on. - **AI love-hate.** He built a curvy-logo generator with Claude in about 10 minutes. He criticizes people acting as a "protein interface" to Claude or ChatGPT without verification, and says reviewing AI output is harder than writing code because it demands a focus switch. - **Security under AI.** Patchstack expected an AI report flood but thought it had more time. It tightened bounty rules at the start of the year, received its first submission from OpenClaw (with a file pointing at localhost), and built AI tooling to triage and ship virtual patches faster. He says Patchstack has "a few thousand" valid reports this year. Frontier models found several WordPress core vulnerabilities (he recalls 5 or 7, one severe), undercutting the "core is secure, plugins aren't" narrative. The host references the "WP2 shell" core exploit in the intro. - **Vibe coding.** The transcript ends around 51:20, mid-sentence, as Reynolds predicts that sites built once Claude Code "got good" will need security updates within 6–24 months. The final ~30 seconds aren't in the capture. ### 🗒️ Notes #### ⏱️ [00:18](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=18s) Cold open - Reynolds frames the episode: one CMS bubble, a conference for all CMSs, time-to-exploit down to ~5 hours, the "WP2 shell" core exploit, fractured plugins, the "vibe coding hangover." - Guest name is garbled throughout the captions ("Machik Pelowski", "Magic Palmowski"); the video title gives Maciek Palmowski. #### ⏱️ [01:48](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=108s) Introductions - Works at Patchstack; organizes CMS Conf "because why not," despite vowing never again after each event. - Coffee lover; joke about knowing nothing about pottery. #### ⏱️ [03:44](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=224s) Early computing - ZX Spectrum clone at ~3, Amiga 500 with 1 MB RAM, Sensible World of Soccer, CD readers and zip drives, reinstalling Windows 95 monthly. - Knew by primary school he'd work in IT. #### ⏱️ [06:23](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=383s) From servers to bridge roles - Cisco certificates, then development, then realized he preferred the whole picture over specializing. - "Developers that can speak to others are pretty rare" — now a growth engineer turning marketing ideas into prototypes. #### ⏱️ [08:44](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=524s) Why WordPress - Documentation was great when he started; theme approach clicked; Joomla, Drupal, TYPO3 had friction. #### ⏱️ [10:23](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=623s) Come for the code, stay for the community - WordCamps were the turning point. - Reynolds: the slogan is on a DrupalCon sticker (Atlanta; he's unsure of 2024 vs. 2025). #### ⏱️ [12:05](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=725s) Drupalisms - A PHP UK talk on Drupal's history of reinvented wheels matched WordPress's story nearly word for word. - Communities repeat each other's mistakes because they sit in silos. #### ⏱️ [13:49](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=829s) Tribalism and reputation - WordCamp US fireside question on tribalism; Reynolds dislikes "just invite them here." - Palmowski: outside its bubble WordPress has a poor reputation, yet many don't know its scale. #### ⏱️ [16:05](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=965s) Scale as a security frame - No other CMS handles that many plugins at ~40% of the web; only a few CMSs pass ~1%, Shopify among them. Drupal around 2% (host's estimate). #### ⏱️ [17:13](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1033s) CMS Conf origin - Followed a bilingual Polish WordCamp; the team chose to invite other CMS communities, self-funded. - Smaller CMSs with scattered communities lack a place to show their work. #### ⏱️ [21:16](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1276s) AI and tool choice - Lower entry barriers mean "there is a tool for this, maybe just use it" beats piling on workarounds. #### ⏱️ [22:58](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1378s) Drupal funding and collaboration (host) - DrupalCon ticket revenue funds sponsored development (host cites the Drupal AI modules). - No premium marketplace means less competition and more module consolidation; Reynolds hopes a Drupal marketplace doesn't erode that. #### ⏱️ [26:26](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1586s) The fractured repository - Dropping the 1,000-install bounty threshold made reports "go crazy." - Most plugins sit on few sites; few companies have 10+ plugins. #### ⏱️ [29:14](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1754s) Statamic comparison - Transparent license pricing with a free solo tier (his description). - Forms and content modeling built in; ACF-style features feel native rather than add-on. - Only one security-talk attendee ever said they ran WordPress with no plugins. #### ⏱️ [32:37](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=1957s) Admin vs. block editor - Reynolds: the editor feels like a different product; a full React admin will take years. - Palmowski: headless publish-webhook control had to be rebuilt in the editor sidebar. - The old admin was strong on accessibility; Gutenberg launched with many a11y issues; a rewrite risks a repeat. #### ⏱️ [36:34](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2194s) Better if less popular - 40% share makes breaking changes hard, especially with volunteer release teams. #### ⏱️ [37:42](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2262s) Product or not - Reynolds: no one runs WordPress like a product with user research. - Palmowski: WordPress hasn't decided who it's for; maybe not being a product is what attracted people; most users don't care which CMS they run. #### ⏱️ [41:06](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2466s) AI love-hate - Reynolds mentions talking with John Blackbourn of the WordPress security team (captions: "John Blackborn"; spelling unverified) about frontier models finding vulnerabilities. - Palmowski built a curve-logo generator with Claude in ~10 minutes. #### ⏱️ [43:23](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2603s) Protein interface - AI used as an excuse for layoffs; people stop thinking. - Reviewing output needs a focus switch; the urge to just merge is the risk. #### ⏱️ [45:42](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2742s) Bug bounty flood - Stricter submission rules at the start of the year; "AI slop" reports; first OpenClaw-made submission. - Patchstack built AI tooling for triage and faster virtual patches; "few thousand" valid reports this year; Wordfence saw the same. #### ⏱️ [47:58](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2878s) Core vulnerabilities - Frontier models found 5–7 core vulnerabilities (his recollection), one severe, in code "everyone watched." #### ⏱️ [49:06](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=2946s) Time to exploit - Weeks, then days, then ~5 hours in last year's report; likely faster now as AI finds more zero-days. - "Keep WordPress updated and you're safe" is outdated. #### ⏱️ [50:49](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=3049s) Vibe coding - Lovable, Bolt (captions: "Bald") let non-coders ship apps with databases and payments. - Reynolds predicts those sites will need security fixes within 6–24 months; capture ends mid-sentence. ## 📚 References - [Episode 34 on YouTube](https://www.youtube.com/watch?v=tmn8Ika1-9o) - [Patchstack](https://patchstack.com/) — annual "State of WordPress Security" reports are the source for the time-to-exploit figure (report not opened here; figure is the speaker's recollection) - [Statamic](https://statamic.com/) - [Wordfence](https://www.wordfence.com/) ## 🗣️ Paraphrase - Palmowski's career runs from a childhood Spectrum to a growth-engineer role where he turns non-technical ideas into prototypes, now in a day with AI. - He came to WordPress for its docs and stayed for WordCamps, but sees every CMS community repeating the same mistakes in isolation, which is why he started CMS Conf. - The plugin repository looks huge but most plugins have few installs, and WordPress needs plugins for things other CMSs build in; the split between core UI and plugin or editor UI shows. - He thinks WordPress's size slows it down and that it still hasn't chosen its audience. - AI speeds him up but punishes unverified use; in security it flooded bounty programs with junk, found real core bugs, and pushed time-to-exploit to hours. ## 📰 Newsletter - **Five hours.** That's how long Patchstack's Maciek Palmowski recalls it took, per last year's report, for a disclosed WordPress vulnerability to get exploited — and he expects this year's number to be lower. On Community & Code, he tells Chris Reynolds why "just keep it updated" isn't a security plan anymore, how AI-written bug reports (including one from OpenClaw pointing at localhost) swamped Patchstack's bounty, and why he started CMS Conf to get WordPress, Drupal, and smaller CMS folks in one room. Bonus: his case that WordPress would be better off a little less popular. [Watch episode 34](https://www.youtube.com/watch?v=tmn8Ika1-9o). ## ✅ Action Items #### DevRel - Developer advocacy: a talk pairing the time-to-exploit trend with a live demo of a virtual patch or WAF rule landing before the plugin update. - Education: workshop on reviewing AI-generated plugin code for the top vulnerability classes Patchstack reports. - Developer experience: publish a "verify before merge" checklist for AI-assisted WordPress plugin work. - Developer marketing: not applicable to this source — no campaign content. - Community management: bounty programs should publish AI-submission rules up front, as Patchstack did. - Internal/external/cross-project: share triage tooling patterns between security vendors facing the same flood. #### OSPO - Policy & Governance: define disclosure timelines that assume hours, not weeks, to exploitation. - License Compliance: not applicable to this source. - Security Management: track mean time from disclosure to patch availability per plugin vendor. - Software Inventory: inventory plugins by install count and maintainer count to flag single-maintainer, low-install dependencies. - Developer Support: guidance for teams shipping vibe-coded apps on who owns updates. - Community Engagement: fund cross-CMS venues such as CMS Conf. - Strategic Alignment: KPI candidate — share of fleet plugins patched within 24 hours of disclosure. #### Community - Maintainers: plan for AI-found reports in release hygiene; budget triage time. - Contributors: "Drupalisms"-style cross-community talks as onboarding material. - Sponsors: examine the DrupalCon model where event revenue funds development (per host's description). - Ecosystem: cross-CMS incident drills on shared PHP dependencies. #### WordPress - Core: reassess the "core is secure" talking point after the AI-found core vulnerabilities. - Core Performance: not applicable to this source. - Core AI: evaluation sets for AI-assisted code review of plugin submissions. - **Core Program Team:** plan for volunteer release-team load when breaking changes are unavoidable at 40% share. - Mobile: not applicable to this source. - Playground: reproducible vulnerability labs for teaching review of AI-written code. - Community: invite other CMS communities as speakers, not only as attendees. - Training: lesson on why "keep it updated" is necessary but insufficient. - Marketing: address WordPress's reputation outside its bubble with scale facts. - Support: not applicable to this source. - Design: map UX seams between list screens, block editor, and plugin admin UIs. - Documentation: restore the documentation quality that drew early adopters. - Photos: not applicable to this source. - TV: caption review — this episode's auto-captions garble the guest's name and company. - Polyglots: bilingual WordCamp formats as a model (per the Polish WordCamp story). - Accessibility: a11y gates on any admin rewrite so Gutenberg-era regressions don't repeat. - Meta: publish repository install-count distribution data. - CLI: not applicable to this source. - Hosting: offer virtual patching or auto-updates that close the hours-long window. - Tide: weight low-install, single-author plugins in risk scoring. - Openverse: not applicable to this source. - Themes: not applicable to this source. - Plugins: review queue guidance for AI-generated plugin submissions. #### The WPOCC - Programs: fund maintainer time for security triage on low-install but widely forked plugins. - Projects: a cross-CMS lessons-learned document seeded from CMS Conf talks. - Funding experiments: test an event-revenue-to-development model like the one the host describes for Drupal. ### FAIR - Technical independence: signed metadata lets hosts push security fixes fast when time-to-exploit is hours. - Policies and covenants: disclosure-window policy tied to measured exploit timelines. - Productized governance artifacts: a vulnerability-response scorecard per plugin vendor. ## 🧪 Hypotheses - H1: Median disclosure-to-exploitation time for WordPress plugin vulnerabilities in 2026 is under 5 hours. - H2: Bounty programs that tightened AI-submission rules see a higher valid-report ratio without a drop in valid-report count. - H3: Most repository plugins have fewer than 1,000 active installs. - H4: Sites built with AI app builders in 2025–2026 show more unpatched vulnerable dependencies after 12 months than hand-built sites of similar size. - H5: Cross-CMS conference attendees report more tool-switching than single-CMS event attendees. ## 📊 Methodology - H1: time-series of disclosure timestamps vs. first exploit attempts in WAF telemetry (Patchstack, Wordfence). - H2: before/after comparison of bounty submissions and validity rates around the rule change. - H3: scrape WordPress.org plugin API active_installs and compute the distribution. - H4: cohort study of scanned sites tagged by build method, re-scanned at 12 months. - H5: attendee survey with a control group from a WordCamp. ## ❓ Questions - What share of AI-found core vulnerabilities would human review plausibly have caught? - Should WordPress.org pull plugins below an install threshold with no maintainer response? - Who patches a vibe-coded site when its builder has moved on? - Can CMS Conf produce shared artifacts, not only talks? ## 🔮 Future Research - Patchstack's next annual report figure for time-to-exploit. - Whether AI triage tooling reduces or shifts researcher incentives. - UX research on the admin/editor split with real editors. ## 💡 Implications - Practice: patching cadence alone can't cover a window of hours; virtual patching or host-level mitigation fills it. - Policy: disclosure timelines built for weeks don't fit hours. - Security: frontier models change which code counts as "well audited." - Education: AI-assisted developers need review skills more than generation skills. - Funding: volunteer release teams carry breaking-change risk at 40% scale. ## 🧠 Learning Styles Assessment - Reading level estimate: not computed with a formula; conversational spoken English with WordPress jargon, roughly grade 9–11 by inspection. #### 👀 Visual learners - Present: frames weren't checked; the transcript mentions a sticker held up to the camera. - Improve: a chart of time-to-exploit over years; a histogram of plugin install counts. #### 🔊 Aural learners - Present: the whole episode is audio-first conversation. - Improve: chapter markers matching the segments above. #### 🗣️ Verbal learners - Present: anecdotes (OpenClaw submission, logo generator, headless webhook). - Improve: a glossary for zero-day, virtual patch, headless. #### 🧩 Kinesthetic learners - Present: none. - Improve: a lab to write a virtual patch for a sample vulnerable plugin. #### 🧠 Logical learners - Present: the weeks-to-days-to-hours trend. - Improve: sourced numbers instead of recollection. #### 🧑‍🤝‍🧑 Social learners - Present: two-person dialogue; CMS Conf as a social venue. - Improve: discussion prompts on tribalism. #### 🧘‍♀️ Solitary learners - Present: none. - Improve: self-check: "Could your site survive a 5-hour exploit window?" #### 🌿 Naturalistic learners - Present: "WordPress is a whale" framing of scale. - Improve: ecosystem-health framing for plugin dependencies. ## 📊 Accessibility Assessment #### Screen reader semantics - Not applicable to this source — video; no page markup assessed. #### Keyboard navigation - Not applicable to this source — YouTube player controls not assessed. #### Contrast and readability - Not applicable to this source — frames weren't checked. #### Text resizing and reflow - Not applicable to this source — video. #### Media and captions - Present: YouTube auto-captions exist. - Improve: auto-captions misspell the guest's name, Patchstack, Statamic, Wordfence, and Bolt; human-corrected captions would fix WCAG 1.2.2 accuracy. #### Forms and interactions - Not applicable to this source. #### Standards reference - WCAG 2.2 AA 1.2.2 Captions (Prerecorded) — accuracy gap; 1.2.5 Audio Description — not assessed. - Content itself raises accessibility: the guest flags admin-rewrite a11y regressions as a risk. ## 🌍 DEIB Assessment #### Cultural breadth - Present: Polish perspective; bilingual WordCamp; cross-CMS focus. - Improve: voices from outside Europe and North America. #### Inclusive language - Present: mostly plain; "AI slop" and "protein interface" are informal. - Improve: define security jargon. #### Neurodiversity support - Present: conversational structure, no chapters. - Improve: chapter markers and a summary. #### Representation - Present: two men discuss; others mentioned by name. Pronouns only as stated in the transcript. - Improve: more varied guests on security topics. #### Psychological safety - Present: respectful tone; critique of leadership stays on ideas. - Improve: not applicable to this source. ## ✅ Logical Validity #### Strong reasoning - Inductive: the weeks→days→hours trend cites Patchstack's own annual data (49:06), a named source. - Causal: removing the install threshold caused the report spike (26:26), a clear before/after. - Analogical: the Drupalisms talk as evidence of shared mistakes (12:05). #### Fallacies - Hasty generalization: "only one guy" in security talks ran no plugins (29:14) is audience anecdote; fix with site-survey data. - Unsupported statistic: "50–70% don't care" about their CMS (39:58) — he says there are no numbers; label as a guess. - Appeal to recollection: 5 or 7 core vulnerabilities, 5 hours — both flagged by the speaker as memory; fix by citing the report. #### Tone of voice - Friendly, self-deprecating ("because why not"), candid about AI both ways. ## 🛡️ DARVO Analysis - Deny: none observed. - Attack: none; criticism of Matt Mullenweg's answer (host) targets the idea. - Reverse victim/offender: none observed. - No emotional manipulation detected; this is a collegial interview. ## 🎯 Conclusion - Bottom line: exploitation now arrives in hours, AI finds bugs in code everyone trusted, and WordPress's scale slows its response. Palmowski's answers: verify AI output, look outside the WordPress bubble, and stop treating updates as a full security plan. - Next steps: read Patchstack's latest annual report for the current exploit window; audit your fleet's plugin install-count risk; check whether your host offers virtual patching. ## 🔄 Refactor Appendix — Episode 34: Maciek Palmowski ### 📚 Literature Atoms (H3) #### [H1] WordPress exploit windows shrank to about five hours > [!quote] ID:rw_01m34j1550ajksqf7wds5q1v9e > And uh in our last report we published last year, it was uh five hours if I remember. **Context & use**: - 49:38; follows "weeks then days." - Speaker's recollection of Patchstack's annual report; cite the report before reuse. **Tags**: #xref #share **Highlight**: [view highlight](https://read.readwise.io/read/01m34j1550ajksqf7wds5q1v9e)  #### [H2] Plugin repository size hides a fractured long tail > [!quote] ID:rw_01m34j165hkzmz74bagyg9ws2m > when you start going deeper and deeper yeah you see it's really fractured **Context & use**: - 28:40; after the bounty threshold story. - Supports inventory work on low-install dependencies. **Tags**: #xref **Highlight**: [view highlight](https://read.readwise.io/read/01m34j165hkzmz74bagyg9ws2m)  #### [H3] Market dominance constrains WordPress experimentation > [!quote] ID:rw_01m34j179t038pgmv0h65bsmqe > I think it would be better for WordPress if it got a bit less popular. **Context & use**: - 36:34; tied to breaking-change risk with volunteer release teams. **Tags**: #xref #aphorisms **Highlight**: [view highlight](https://read.readwise.io/read/01m34j179t038pgmv0h65bsmqe)  #### [H4] Unverified AI use turns people into relays > [!quote] ID:rw_01m34j18b1srv4cfmhjhkvcw7t > they are kind of a protein interface to claude or chat GPT or whatever and um this approach without any verification it's it's just bad **Context & use**: - 44:00; he uses AI daily and sees frequent mistakes. **Tags**: #xref #aphorisms **Highlight**: [view highlight](https://read.readwise.io/read/01m34j18b1srv4cfmhjhkvcw7t)  #### [H5] Updating alone no longer keeps WordPress safe > [!quote] ID:rw_01m34j19frxw9da8rvp9e6srrf > Like just keep your WordPress up to date and you are safe. We already know it's it's not true. **Context & use**: - 50:12; zero-days mean no update exists when exploitation starts. **Tags**: #xref #share **Highlight**: [view highlight](https://read.readwise.io/read/01m34j19frxw9da8rvp9e6srrf)  ### 🧠 Permanent Candidates (H4) #### [P1] Patch cadence can't cover an hours-long exploit window **Claim** (one sentence, Courtney's voice): When exploitation follows disclosure within hours, the defense that matters is the layer that acts before an update exists — virtual patches, host rules, or disabling the component. **Evidence pointer**: [[#[H1] WordPress exploit windows shrank to about five hours]], [[#[H5] Updating alone no longer keeps WordPress safe]] **Scope & conditions**: holds for disclosed and zero-day plugin bugs; weaker for sites with no internet-facing attack surface. **Links**: - [[wp-audit]] — because applies-in plugin security work - [[Alarm fatigue before adding alarms]] — because contrasts on detection vs. prevention  #### [P2] Review is the new bottleneck in AI-assisted work **Claim** (one sentence, Courtney's voice): AI shifts effort from writing to verifying, and verifying is harder because it needs a deliberate focus switch the writing used to provide for free. **Evidence pointer**: [[#[H4] Unverified AI use turns people into relays]] **Scope & conditions**: holds where output ships to users; weaker for throwaway prototypes like his logo generator. **Links**: - [[The Maker Should Not Grade Its Own Homework]] — because extends - [[readwise-deep-read]] — because evidence-for verification gates  ### ✏️ Fleeting Queue - [F1] Pull Patchstack's latest State of WordPress Security report and confirm the ~5-hour figure — https://patchstack.com/ #fleeting #inbox - [F2] Is CMS Conf taking talk proposals for a next edition? — cross-CMS DevRel angle #fleeting #inbox - [F3] Compare Statamic's built-in forms/fields with WordPress core + ACF for a post on "framework vs. CMS" #fleeting #inbox ### → Things 3 (max 2 actions) - [ ] Verify Patchstack's time-to-exploit figure before citing it — Community & Code ep. 34 #things  📄 **Full text:** [[Full Document Contents/Articles/Episode 34 Maciek Palmowski.md|Episode 34: Maciek Palmowski by Maciek Palmowski]] ## Highlights - companies that have more than 10 plugins in the repository. So in the repository on the outside when you look at the number of plugins uh it's huge but when you start going deeper and deeper yeah you see it's really fractured and there are really a ([View Highlight](https://read.readwise.io/read/01m34j165hkzmz74bagyg9ws2m)) - Note: Repository size overstates depth: most plugins have tiny install counts, few vendors ship 10+ plugins. - Tags: atom/literature/h2 - and that was always kind of my small wish that I think it would be better for WordPress if it got a bit less popular. [snorts] So, it could [clears throat] beame a bit more agile, a bit more crazy, a bit more um a easier to experiment with. Uh because right now those 40% I mean it's ([View Highlight](https://read.readwise.io/read/01m34j179t038pgmv0h65bsmqe)) - Note: Market share as a constraint on experimentation and breaking changes. - Tags: atom/literature/h3 - kind of love love this term that they are kind of a protein interface to claude or chat GPT or whatever and um this approach without any verification it's it's just bad I mean every day I ([View Highlight](https://read.readwise.io/read/01m34j18b1srv4cfmhjhkvcw7t)) - Note: AI output without human verification; review becomes the hard part of the work. - Tags: atom/zettel/z1 - to be exploited, it was weeks then days. >> Yeah. >> And uh in our last report we published last year, it was uh five hours if I remember. ([View Highlight](https://read.readwise.io/read/01m34j1550ajksqf7wds5q1v9e)) - Note: Time-to-exploit fell from weeks to days to ~5 hours per Patchstack's prior annual report (speaker's recollection). - Tags: atom/literature/h1 - that we already knew that are that were kind of outdated, right? Like just keep your WordPress up to date and you are safe. We already know it's it's not true. But now we see how much untrue it is because I mean five hours for exploitation was a year ago. So right now I I I ([View Highlight](https://read.readwise.io/read/01m34j19frxw9da8rvp9e6srrf)) - Note: "Keep it updated" is no longer sufficient advice when zero-days get exploited within hours; virtual patching/WAF layer matters. - Tags: action/h1