Episode 34: Maciek Palmowski  🔗 **Source:** [Episode 34: Maciek Palmowski](https://www.youtube.com/watch?v=tmn8Ika1-9o) > [!note]+ Document Notes > --- > tags: [community-and-code, wordpress-security, ai-assisted-security-research, plugin-ecosystem, cms-interoperability, vibe-coding] > author: Maciek Palmowski > source: Community & Code > reference: https://www.youtube.com/watch?v=tmn8Ika1-9o > date created: 2026-09-22 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > # 🏷️ Title: Episode 34: Maciek Palmowski > ## 🧭 Table of Contents > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [🗒️ Notes](#️-notes) > - [📚 References](#-references) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > ### 🔗 References > - [Episode 34: Maciek Palmowski (YouTube)](https://www.youtube.com/watch?v=tmn8Ika1-9o) > - [Patchstack](https://patchstack.com/) — the guest's employer (captions render it "PatchAC" / "patch stack") > - [Statamic](https://statamic.com/) — Laravel-based CMS the guest cites (captions render it "static") > - [Wordfence](https://www.wordfence.com/) — mentioned as facing the same AI-report flood (captions: "word fans") > ## 📝 Summary > - **What happened:** Host Chris Reynolds interviews Maciek Palmowski, growth engineer at Patchstack and co-organizer of CMS Conf, on episode 34 of Community & Code (51:49). They cover his path into tech, why WordPress drew him in, CMS tribalism, the fractured plugin repository, Gutenberg's UX split, AI's effect on security research, and vibe-coded sites. > - **Why it matters:** Palmowski says Patchstack's last annual report measured about 5 hours from vulnerability disclosure to exploitation, down from weeks and then days. He says AI now surfaces zero-days, including in WordPress core, that human researchers missed. "Keep WordPress updated" no longer covers the risk window. > - **Key stakeholders:** plugin authors, site owners and hosts, security vendors (Patchstack, Wordfence), bug bounty researchers, the WordPress security and release teams, and organizers of cross-CMS events. > - **Risks and tradeoffs:** AI-generated bug reports flood triage queues (Patchstack tightened bounty rules and added AI tooling); a React admin rewrite risks repeating Gutenberg's early accessibility regressions; vibe-coded apps built on Lovable/Bolt-style tools ship with databases and payments but no maintenance plan. > - **Bottom line:** WordPress's 40%-scale is both its moat and its brake, and the security window has shrunk to hours. Cross-CMS exchange and verification discipline are the two fixes the guest keeps returning to. > ## 📖 Main Content > - **Career as a bridge role.** Palmowski started on a ZX Spectrum clone at about age 3 (he says 37 years ago), moved through an Amiga 500 and PCs, earned Cisco certifications, then chose generalist work: a developer who can talk to non-technical teams. His title now is growth engineer, the technical person inside Patchstack's marketing/growth team. He says AI cut prototype time to "one day work tops." > - **Why WordPress.** He says WordPress documentation and its theme-building approach "clicked" where Joomla, Drupal, and TYPO3 had friction. WordCamps kept him: "came for the code, stayed for the community." Reynolds notes that slogan is a DrupalCon sticker. > - **Tribalism across CMSs.** Palmowski describes a PHP UK talk on "Drupalisms" that would fit WordPress if you swapped names and dates. Reynolds reports that at WordCamp US someone (name garbled in captions; unverified) asked Matt Mullenweg how to fight tribalism, and the answer was to invite other communities to WordPress events — Reynolds isn't satisfied with that. > - **CMS Conf origin.** After a bilingual Polish WordCamp (edition and year not stated clearly in the captions; unverified), the organizers agreed to run a cross-CMS conference without Foundation support. He says smaller CMSs, including a new Polish one (captions: "MDCMS", unverified), lack venues to present. > - **AI lowers the specialist premium.** Because AI lowers the entry barrier to any tool, he argues people should pick the right tool instead of adding "a gazillion of workarounds" to their default CMS. > - **Funding and collaboration contrast (host).** Reynolds describes DrupalCon tickets at $800–900 funding the Drupal Association's sponsored development, including Drupal's AI modules, and says the absence of a premium-module market makes Drupal maintainers merge similar modules rather than compete. These are the host's claims, not verified here. > - **The fractured repository.** During a month-long Patchstack bug bounty, lifting the 1,000+ installs rule let researchers download the rest of the repo, and reports spiked. He says most plugins don't reach even a few thousand installs and few companies have more than 10 plugins in the repository. He doesn't remember exact numbers. > - **Built-in vs. bolted-on.** He cites Statamic shipping forms and custom fields/content modeling in core — features that are large commercial plugins in WordPress (ACF is his example). He calls WordPress "more a framework than a CMS." At his security talks only one attendee ever reported running WordPress with zero plugins. > - **UX dissonance.** Both describe the jump from the list screens to the block editor as jarring. Palmowski had to add a publish-webhook control to the block editor sidebar on a headless site because the left-menu option disappears in the editor. He warns an admin rewrite could reintroduce accessibility problems the old admin didn't have. > - **Less popular, more agile.** He wishes WordPress were less popular so it could experiment; at 40% share, breaking changes are hard, especially for volunteer release teams. He says WordPress still hasn't decided whether it's for bloggers, agencies, or enterprise, and that 50–70% of users (his guess, no data) don't care what CMS they're on. > - **AI love-hate.** He built a curvy-logo generator with Claude in about 10 minutes. He criticizes people acting as a "protein interface" to Claude or ChatGPT without verification, and says reviewing AI output is harder than writing code because it demands a focus switch. > - **Security under AI.** Patchstack expected an AI report flood but thought it had more time. It tightened bounty rules at the start of the year, received its first submission from OpenClaw (with a file pointing at localhost), and built AI tooling to triage and ship virtual patches faster. He says Patchstack has "a few thousand" valid reports this year. Frontier models found several WordPress core vulnerabilities (he recalls 5 or 7, one severe), undercutting the "core is secure, plugins aren't" narrative. The host references the "WP2 shell" core exploit in the intro. > - **Vibe coding.** The transcript ends around 51:20, mid-sentence, as Reynolds predicts that sites built once Claude Code "got good" will need security updates within 6–24 months. The final ~30 seconds aren't in the capture. > ### 🗒️ Notes > #### ⏱️ [00:18](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=18s) Cold open > - Reynolds frames the episode: one CMS bubble, a conference for all CMSs, time-to-exploit down to ~5 hours, the "WP2 shell" core exploit, fractured plugins, the "vibe coding hangover." > - Guest name is garbled throughout the captions ("Machik Pelowski", "Magic Palmowski"); the video title gives Maciek Palmowski. > #### ⏱️ [01:48](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=108s) Introductions > - Works at Patchstack; organizes CMS Conf "because why not," despite vowing never again after each event. > - Coffee lover; joke about knowing nothing about pottery. > #### ⏱️ [03:44](https://www.youtube.com/watch?v=tmn8Ika1-9o&t=224s) Early computing > - ZX Spectr [music] [music] Hey, welcome to Community Code. I'm your host, Chris Reynolds. My guest today has, like me, been in WordPress for something like 15 or 20 years. And somewhere along the way, he decided that the fix for being stuck in one CMS bubble his whole career was to start a conference about all of them. Machik Pelowski works in security, specifically at PatchAC, which means he spent this year watching something unsettling happen. The amount of time between a WordPress vulnerability getting discovered and someone actually exploiting it in the wild has gone from weeks to days to about 5 hours, according to last year's data. And we know that to be even faster now with the recent WP2 shell exploit in WordPress core. AI assisted research is finding things human researchers never would have caught. We also get into why WordPress's plug-in ecosystem is even more fractured than the repository numbers make it look like. The vibe coding hangover nobody's talking about yet. and why he thinks WordPress being this big might actually be the thing holding it back. This is Machek Pamski on Community and Code. Welcome to Community and Code, the podcast where we talk to the human beings behind the commits. And today uh the human being that I am with uh is Magic Palmowski. Magic has been in the WordPress community for a really long time. Uh you're currently working at PatchAC, I think. Is this where I recognize your name? uh and you are I think fairly recently I think that's safe to say the uh one of the organizers of CMS conf um welcome to the show magic and uh tell us about yourself. Uh so apart [clears throat] from the things that you already mentioned so yeah I do work at patch stack and uh I decided that yeah I will organize another conference because why not >> um >> why not yeah it's surely not >> why not >> an overwhelming amount of of time energy and >> and it's not that every every time after I organize a conference I say that I will never ever ever do it again. So, >> so yeah. Um, yeah. And apart from it, um, I'm a huge coffee lover. So, when you sent me some questions about what can we talk about and I mentioned not about pottery, later I realized, but we could do a bit about it because I do like my coffee served in a very nice cup. So, [laughter] >> why does pottery get singled out? Why is that the one thing or like anything but not pottery, >> you know? I mean it it was like the one of the most abstract thing that came to my head because I I really don't have a clue about it and I have some friends that know their stuff around it and I was always listening with this face like uhhuh uh so it's probably the face that most people do when I started to talk about my interest in different parts of AI and when you start going deeper and deeper and you understand it entirely and then you see that some of your friends are Uh-huh. Uhhuh. >> Perfect. Yeah. >> Well, tell me about your uh your sort of journey into tech like what what brought you what made you interested in tech to begin with and and what sort of things did you uh originally sort of like gravitate toward? So uh my story in tech started very very early because and it was all all thanks to my dad because um he managed to buy a Zactic Spectrum computer which was kind of you know the clone of the of Timex and um I was around three back then and my dad tried to understand how it works. So by saying I I was three it means it was 37 years ago. So it was a long time ago and um so yeah my dad tried to really understand how everything works. And from the stories I heard I always like to sit on his lap and kind of look what is happening. I didn't had too much to say back then because I was just a small kid. So >> from all the parents story I was just looking and drooling. So this was kind of my thing. But it turns out that um it kind of worked. It kind of worked because later on like every kid, right? First the games, right? So I was playing a lot of this on on this Spectrum computer. Then it was the time for I think we had first the Amigga 500 with one megabyte of RAM. Not the half it was. So yeah, it was like the high end of AMIA 500. Uh and at some point I apart from kind of uh playing for example sensible world of soccer which was really amazing. I still think FIFA is nothing compared to it. Uh I started to wonder yeah how it works. How it works. And um also my dad also was a bit adventurous in trying to understand something. So so I still remember the first time how when when we tried to kind of connect the uh a first CD reader to a computer and yeah back then it was like whoa or a zip drive or or or a lot of things. So so so we started we tried a lot of things we experimented. Of course, later the PC era came in, so kind of reinstalling Windows 95 each month was kind of a thing. And kind of so on. So, and at some [clears throat] point I kind of I'm when I went to primary school, I already knew I will be doing something in it. I just didn't know what. >> At some point, I thought I will end up more into managing servers and everything. I even have some Cisco certificates. uh but in the end kind of uh I went more towards uh development and at some point I realized that uh while writing co code is cool uh I think I did hit my limit because I was always less interested in specializing in just one thing but I always prefer to kind of understand the whole picture. So someone would say hey you will be a project manager but uh but in a way at some point you you remember when was this moment when everyone was hiring devils and everything >> that's that's when I kind of realized that that is kind of a job for me because um it turns out that developers that can speak to other others are pretty rare and it's really problematic to find those and kind of my career went more uh in in in this route kind of being this bridge between very often technical and less technical teams. For example, right now uh I'm I have this title of uh a growth engineer which kind of means that I am the uh technical person in the marketing growth department and uh when >> oh is that when they have means >> yes to be a growth engineer >> and it's really fun because they always have a lot of great ideas but often they just don't know how to make them real and that's my thing >> and and right now with AI it's it's very simple especially to to try those ideas because now like making a prototype is very often like a one day work tops and we can see how it works and that's the thing that I can really kind of connect those less technical people with more technical things and um yeah that's kind of my journey I want to talk about CMS conf and like the idea behind that and I want to talk about AI but uh and I want to talk about uh AI particularly in the context of patch stack where you currently work because I think that's a really interesting thing but before we get that that um you're looking at your history you have a lot of sort of specifically WordPress WordPress focused experience uh and I'm wondering what drew you into WordPress specifically um what other sort of CMS's uh were you or have you looked at um and played with and and why why WordPress has been a theme that has carried you through you know a while. >> Okay, so um the story with with with WordPress is pretty funny because uh right now a lot of people will say that um WordPress documentation sucks. >> That's kind of the thing. But the truth is the thing that kind of drew me to >> Yeah. That's the thing that drew me to it too. Yeah, >> it was the documentation because when I started the documentation was great >> and I kind of loved their uh their approach on how themes were built. It kind of clicked it it it was a thing because I remember I tried uh Jumla. I think I tried Drupal. I tried some other less popular CMSs and even few I think typo 3 and some um but there was always some friction. it didn't click that well and with WordPress it was like bang it works and I was like and uh so I I I often say that I kind of came for the code state for the community because uh kind of the biggest turning point was uh discovering word caps >> exactly that >> and and what's what I what is interesting about this uh the sticker that I have that I just showed on camera so if you're listening only then it's a sticker that says come for the code stay for community, which is exactly what Magic just said. Um, that came from at Drupal Con. That was uh I I went to Drupal Con in 2025, I guess. Uh, it wasn't this last year, but the year before, uh, in Atlanta. Um, maybe it was the year before that, actually. Um, 2024. And anyway, the one of the first things I saw was this sticker that spoke to me about like why I've been in the WordPress community for 20 years. Um, and but it was at a Drupalcon, so obviously it's the thing that Drupal people feel. So like that that was that was like the beginning of of of just this this realization that like it doesn't matter. And that's why I'm really interested in CMS compon uh because it doesn't really matter uh what thing you're working on. We're all basically the same and we all have the same like I mean the Drupal community is is very very very similar to the WordPress community. Oh, it is >> to the point that I wish that we would each other more. >> I mean, to be honest, I I still remember I was once at PHP UK in London and I remember there was one talk about Drupal and it was um about a thing called Drupalisms. So all the weird things that happened in Drupal history, all the weird stuff uh that were invented along and I sat there, I listened to it and I was like, "Huh, it sounds exactly like WordPress story but with a bit different dates and different names for stuff we inver each each team invented, but we made so many same mistakes about, for example, reinventing the wheel and whatever." I was like, if I would take this talk like word by word and just swap Drupal to WordPress and some minor things just to to to match the ecosystem, they would fit like totally and that's kind of the thing about the a lot of those communities are really similar to each other. Uh we very often had the same problems. we solve some things and so on and so on. And very often we don't know about each other and the fact that for example maybe someone already bumped into this problem. Maybe they already learned that maybe trying to solve it won't work or maybe you can do it a bit differently. But sadly, a lot of those communities are kind of hidden in silos or bubbles or whatever you call them. And very often there is a bit of this tribalism. >> My CMS is better than yours. No, it's not. >> Yeah. Yeah. >> That's that's that that's the thing. And um >> well, and that was actually something >> that was actually something that Mike Demo asked uh Matt uh the other day at Word Camp US uh during the the the fireside chat thing. >> Um which was like how do we how do we sort of combat this tribalism? And Matt's response, which I'm not super satisfied with, was well, we should just invite them here. But I don't know that inviting them to a WordPress event is the solution. >> No. I mean, one of the problems that kind of WordPress has is how to put it, it doesn't have the best reputation apart from its bubble. And when I at some point started really traveling to other conferences and very often when I said yeah I'm from the WordPress world and you could really often say uh this space yeah I don't know we're sorry are you sure you understand what we are talking here yeah things like things things like this but when you start talking about it and kind of for for example so many people still don't know how big WordPress is. And it's not about the fact that yeah, we love to brag about those 40 40%. But it's it is true. It's huge. I mean, we can like we can say that like WordPress is the number one CMS you go for because it's that popular. And this is kind of this this cycle because people will try next to use WordPress because they already used it or they know someone who used it and so on and so on. So yeah, WordPress is really popular and like uh and and still a lot of communities are looking at it like yeah sorry sorry that you're there but yeah >> no that's that's not a problem and uh I I often also had the talk about WordPress security because when we look at it um I mean the whole topic I mean we we could spend like a whole a whole day talking about the is the WordPress security good or bad because it's a very broad topic but the truth is that there is no other CMS that has a problem of handling that many plugins of having this 40% of the internet uh on its hand. So it's a totally different scale. >> Yeah. I mean if if I remember from from from the stats uh there are only a few CMS's that crossed the I think the five or 1% something like this. So >> and one of them is Shopify. >> Yeah, I know. the largest the largest competitor is is like Shopify and and I don't know if Squarespace is still up there but >> um but yeah the the >> Jumla Drupal the other actual open source CMS's have have dropped way down uh I think Drupal is is maybe at like >> 2% or something like that >> something like this yeah so >> and and I still remember the moment when WordPress Jumla and Drupal were kind of sharing the market >> yeah once Once upon a time. Yeah. >> Is is the this sort of like getting people to to to see to see things outside their own bubble the sort of uh idea behind uh CMS. Talk about CMS. I mean the idea behind it was um because it was like a kind of a natural progression because we just uh wrapped up word campaign uh last year and uh it was the first bilingual Polish word camp that happened and it worked really well. Uh a lot of people were uh were very happy. A lot of them saw Poland for the first time. So in general it was it was a huge success and um we had this last last chat we're just wrapping up everything make make sure that we uh that we had all the formalities uh done and everything and after I said look I have an idea it's maybe a bit crazy and if you think it's stupid just uh I mean we can drop it and maybe think about just the next edition. But what if we will do something on our own without the foundation support obviously because it's on on our own. uh but we'll invite other CMSs because we we we already kind of decided uh that by doing it Billing well we kind of made this step forward in bringing new people outside of outside from Poland which was a great so let's do another step now let's invite people from different communities from different technologies and um I won't lie there there kind of was a part of me that thought okay and now I hope that everyone say okay no maybe let's let's skip it's it's too much but everyone said yeah let's do it and I was like hhu okay so this is how all your dreams of not making another conference just went through the windows but uh I'm I'm really happy that that it happened because um we had quite a lot of discussions with with different people from from different communities And a lot of people feel that yeah we we definitely need something like this. Um I was also very surprised that for example a lot of smaller CMSs are kind of missing a place to kind of show up. >> [clears throat] >> Um because if you are big enough so you are you're WordPress you are Drupal and you have already kind of the bigger community this your events and everything it's easier but if you are smaller and especially if your community is really spread around the world or it's really difficult to organize an an event. >> Mhm. Uh but having this space that kind of invites you and you can kind of show up with with with your CMS to show others what you can do. Yeah. And we kind of have like uh for example one really small Polish CMS just kind of launched. I think it was called MDCMS. uh they were really open and they said yeah for for for us it's like a great opportunity and >> and yeah I I really hope that um that that will work because um like I said we really need to have more spaces to exchange those uh ideas to together because again especially with with with AI because okay I get it that few years ago when you had to kind of learn everything from scratch, uh being a specialist in something was a bit more important. And right now the entry barrier is so much simpler to kind of start using whatever tool you want that you that that I think that mo more people should kind of open their their minds and kind of change the approach a bit from yeah I always use WordPress Drupal whatever you want want to say and I will do everything I will add gazillion of workarounds to make it work for you >> instead of Yeah. There is a tool for this. Maybe just use it. >> Yeah. >> Yeah. Well, I mean even to your point uh earlier about like the the Drupal Drupalisms uh talk that you were talking about like like I feel like because we are are in our tribal sort of silos uh we all are sort of making the same mistake and reinventing the wheel without like looking at what other communities are doing and and if there was a space when there is a space uh to to collect collaborate then like we learn a lot of stuff like I there's there's things that that that I took away from from Drupal Con that I wish the WordPress community had and there's things that I was able to communicate uh like risks to the Drupal community that like things the that I see in the WordPress community um like uh you know the the the funding model for Drupal for uh contributions like Drupal Con's cost a lot of money. They're like $800, $900 a ticket, right? Um, and the reason part of the reason why they are so expensive besides the fact that like tech conferences outside of the WordPress ecosystem are expensive, which a lot of us in the WordPress ecosystem who have never gone to a tech conference don't realize like that this is that's normal and this is >> it was a huge shock for me too for the first time. I was like, Jesus, how it's possible that a conference cost that much? I mean, I went to a word camp Europe which costed >> Yep. >> nothing compared. >> Uh yeah, but but that money then goes it actually pays the the Drupal Foundation and then it gives them funds that they can allocate to sponsor development on projects that the uh the foundation and the membership uh think is uh worthy to to to create. So like that's how like the AI uh modules uh and AI tools for Drupal was developed was because of of sponsored development where they were [clears throat] able to like find an agency or a couple agencies to work with to like build this stuff out. And I think that's really that's really valuable. Um, and and the other thing that I I sort of took away from from Drupal was like because there's no marketplace ecosystem of like premium plugins in their uh in that [clears throat] context like there isn't nearly as much competition like in the WordPress ecosystem. >> [clears throat] >> If I have a a plugin or an idea for a plugin, I'm less likely to tell you about it because at some point I might want to make that plugin premium and and get paid for it. In Drupal, if if we have two different modules, but they do very similar things, they're both SEO modules or whatever, then then we might be more likely to collaborate to make one or the other of them better and combine their skills uh in to make a the better canonical like Drupal module for that thing. Um and and so there's this there's a lot more of this like community communal sense that I that I I miss and I really would like that in the WordPress ecosystem, but on the same side they're not able to sell stuff which is what is a lot of people's livelihoods. So like there's like there's sort of different things. Um and especially as as Drupal is trying to uh edge their way into creating like a marketplace like one of the things that I was saying is like was that like my observation was you know you guys are have a really good thing with like being sort of having this sort of sense of community and and collaboration and whatever don't like I am hoping that m having a marketplace doesn't doesn't kill that because that's really cool. It's a really cool thing that you have that we don't have as much. I mean, we do, but we don't. Everybody's sort of frenemies because we're all sort of we're in competition with each other even as we're working alongside it, which is, you know, it's good, but also it means that we've got this like totally fractured ecosystem of like a million different options for every single thing under the sun. Um, rather than like a couple really good things, which is even a thing uh that Matt was talking about uh the other day as well is like like there's just there's a lot of stuff. Um, yeah. And >> and more stuff isn't necessarily better. >> I mean, for me, it was very surprising when we were once doing u bug bounty and a patch stack and we were trying to kind of find as many vulnerabilities during one month. We even kind of changed the rules a bit to make it uh >> uh so so we could clean as as as as much from the repository as possible. And one of the things uh that really surprised me back then was um that at some point all the reporting started to go crazy. And it started to go crazy because um all the researchers finally downloaded the missing part of the repository on their drives because before it we had the rule that you had to have like thousand plus installs or something like this. >> But it's the WordPress ecosystem. We are talking about 40% of the market. >> Having 1,000 installs should be like like this, right? No, it turns out that really the amount now I sadly don't remember the numbers but I was really shocked that uh while WordPress has this huge repository. >> Mhm. >> Most of the plugins aren't even installed on those thousands websites. >> Yeah. >> And that's let's be honest that's nothing. >> Yeah. I mean compared to the ecosystem. So I was I I was really surprised by it. I remember that back then we also did quite a uh quite a lot of checks for for the repository for example also that there there are really not that many companies that have more than 10 plugins in the repository. So in the repository on the outside when you look at the number of plugins uh it's huge but when you start going deeper and deeper yeah you see it's really fractured and there are really a lot of things that maybe it would be better if I know some of them will be for example in core and the plugins we could just remove and that's for example a thing that Um I do like about uh there is this Laravel CMS called static. >> Mhm. >> This is one of my one of my favorites. Uh and they also have a bit different uh model when can when it comes to kind of funding because for example with them yeah just pay for it just pay for a license and you can do whatever you want. I mean there is a free tier for for one person but but in general uh I mean their approach is very transparent and it kind of makes sense but um what's interesting is that static for example out of the box has a few important features uh then when we look at WordPress those are pretty important plugins that really earn a lot of money. So for example forms for example uh creating additional fields or modeling content right uh so those two things and they are built in into statamic like uh out of the box and the thing that I really like when I started using it for the first time was that I get it that WordPress has this kind of I kind of like to say that that it's kind of more a framework rather than a CMS because you do have to add stuff to make it working and every time when when I had one of my security talks and I mentioned that yeah that plugins are the biggest problem from from the perspective of security and I asked okay how many of you have a WordPress without any plug-in and during all the talks I did there was just one guy one guy that said I don't use any plugins I was like okay that's a surprise I don't even know how that works. I don't even know how you can have a WordPress site without any plugins. >> I'm I'm I'm also I'm I'm I'm still a bit shock shocked at it. Although maybe he just put a lot of things into functions PHP. >> I mean, yeah, I guess I I formally >> that is that is the only thing I could think of. Yeah. But >> yeah, formally it's okay. Yeah, I >> but okay. He has it. And um and uh the thing with plugins is that very often they have a bit they have their own UI >> and it's very easy to recognize where WordPress ends and plug-in begins. >> Yeah. >> And for example, ACF, one of my favorite plugins. I I use it very heav heavily. Uh, I liked it always and it's a really great plug-in, but Statamic has the same builtin and when it becomes a natural part of it. >> Yeah. >> It's such a different fe feeling of working with it when you when you have exactly the same options but you the same option but you feel that it's a part of the CMS, not an add-on. And it's it's a really great thing. So I don't know, maybe it's really time that maybe WordPress should add a bit more stuff inside of the core. Not sure. >> Or maybe just build a better UI UX system and kind of more enforce it. >> Yeah. Well, that dissonance uh between like one experience and like like you know being inside feeling like you're inside of WordPress and then feeling like you're inside of a different experience. I mean, that carries into Gutenberg, too. Like, that's one of the my biggest uh complaints about about Gutenberg and the site editor is like, it's great. It's fine, and it's built into core, but it feels so much different than the rest of WordPress. Like, I I get that rebuilding the entire admin in React is is not going to be a simple task and it's going to be something that's going to take many, many years to do. And then maybe at the end of it we'll be like React probably wasn't the thing we should have we should have used next or we should have used Astro and then we'll rebuild the entire thing again in some other JavaScript framework. But like and by the time we're done with that there'll be a new one. Besides all that, like it's the experience of like it's it's almost jarring to like go from like the posts list which is this looks more or less the same as it did for the last I don't know 15 or so years maybe since inception really and then go into uh the Gutenberg editor where it's like a completely different experience and actually behaves different too. >> Yes. I mean, for example, and this was something that I was uh I I really had to solve lately because we had this one option to publish our because we we were on a headless WordPress. So to publish the content uh and so to kind of trigger some web hook and we had an option in the in the in the left bar but the moment you go to a post it disappears. >> So yeah that's the thing. So I had to add a extra module inside of the kind of right Gutenberg sidebar so you can [clears throat] do it. And it was like >> it's the moment when WordPress is having a different experience than WordPress. >> That's really problematic. Although I remember there there there were some drafts and we can already see it in some parts uh how probably the uh the new version of the admin will look like because we can kind of see it in the theme editor and and so on and so on. >> I can imagine then it will take years for everyone especially who build their custom UIs to kind of migrate again and again. So, uh, and yeah, some some can say, "Yeah, but that's just UI. No biggie." Oh, it's it's a huge biggie. It's a huge biggie. And it's, uh, and it's also a big problem from many perspectives. I mean, even accessibility. >> Mhm. Because that's kind of the thing we let's call it the old admin was really good when it comes to accessibility. >> Then Guten Gutenberg came and there was a long list of problems from the accessibility point of view. >> So now imagine that we decide okay let's make a total switch and >> so here we go again. [laughter] we will have to sort a lot of uh of problems we will introduce again. >> So on the other hand, yeah I I get it managing um managing a CMS that half of words half of the world depends on it's pretty problematic. I mean it's it's a whale. It's a whale. So it's it's for sure not something that you can say okay let's make a switch let's go. No it doesn't happen this way. So, and that was always kind of my small wish that I think it would be better for WordPress if it got a bit less popular. [snorts] So, it could [clears throat] beame a bit more agile, a bit more crazy, a bit more um a easier to experiment with. Uh because right now those 40% I mean it's a huge burden. >> Yeah. And I I I wouldn't like to be the part of the release team that I never was. Uh that would have to introduce some critical changes and some breaking changes and um especially with the current funding model when you are doing it as a volunteer. So [sighs] >> yeah. Yeah. Yeah. No, for sure. Um, yeah, I've I've always the the the frustrating thing for me has always been that like it's this huge has this huge market share of the internet, but it's not like there's no one that is driving development from like the perspective of like treating it like a product that is actually doing like real sort of product research like what actual products do, you know, like it's just it's just here's some stuff that that I think maybe is good. Um and and the I in this sentence is whoever happens to be the the release lead or you know project project leadership whatever like >> and and that's just I mean it's gotten us this far and you know power to you know the powers that be that that got us this far. But like it's that's when you're when you're this massive of a whale, um maybe it's good to to figure out like, okay, where are what are the things that are actually the pain points in the the largest pie slice of of this this usership? Yeah, I still think that we still have a bit of um problem with deciding what we are. >> Mhm. >> Because um and this is in a way really fascinating that WordPress is a CMS that will be described as a great fit for a blogger, for an agency, for an enterprise. how it's possible at the same time. It's it's kind of seems a bit impossible to make it work for everyone. >> Mhm. >> Uh again looking at the market share, it seems that it somehow works >> uh this way. But the truth is that um it's really impossible to kind of make everyone happy. >> Yeah. >> And uh this is kind of the thing that you mentioned about that may be because maybe we should treat it a bit more like a product. But maybe on the other hand, maybe that's also a thing that kind of brought people to WordPress that it kind of wasn't a product, right? It wasn't a product. It was it was this cool CMS. But on the other hand, it's it's it's also a bit different perspective because when we for example meet at those word camps and every uh most of those people are already interested in it and they are like at the different level of of being interested in the CMS but probably the truth is that I don't know 50 70% not sure there there are no numbers kind of don't care it's it's a software that they put data in and it shows to the world or it's an e-commerce and add product and we don't care if tomorrow we would switch to spot uh to Spotify to Shopify that's also okay we just have to learn when the when the some of of the things are and how it works but that's it there are no feelings towards uh which in a way is also healthy because let's be honest, it's just a piece of code. >> Talk about uh talk about your your view of how AI is is is changing. I know that you have some thoughts about this, but I but I also like I was actually having conversations with John Blackborn from the WordPress security team this week um talking about uh really sort of the way that that AI and in particular frontier models are able or are not just able but actively changing what uh security looks like in open source because they're able to find all these vulnerabilities in a way that human beings aren't able to And obviously that is a thing that that is relevant to you in your role at patch stack which is sort of what patchstack does too. Uh so like like there's the security thing. Um and that's the reason why we've gotten a bunch of security patches in the last uh month or so. Um but also like just in general as a tool uh you know you mentioned um maybe we don't need uh to necessarily rally around a single CMS because we have AI that can that can build frontends for anything. So, um overall I do have a bit of a lovehate relation with with AI because um on one hand I really am amazed how many things it can do and how quickly it can do it. uh like I think two days ago I even had this small experiment because I spotted there is lately one pattern and few companies are using one types of the logos. It's like a curvy thing on the bright color whatever and um I decided I have too much tokens to burn. So, but so I built a a logo generator that allows you to kind of build those curves. And I was like, "Okay, cool." And it was fun and it did a lot of things that I wouldn't know how to do in JavaScript about kind of uh all those curves and kind of tensions whatever. It's something that I that I never fully even understood why using curves in Photoshop or or Illustrator. And here I would have to implement it. the cloud managed to do it in like 10 minutes alto together. So, so that's that's the amazing part. On the other hand, um AI kind of uh became like this u one of this universal ways. Okay, we can fire people because of AI >> or a lot of people got so lazy that they really stopped thinking and it's just I kind of love love this term that they are kind of a protein interface to claude or chat GPT or whatever and um this approach without any verification it's it's just bad I mean every day I because yeah, every day I'm using a lot of it. Uh, and I see how often it makes mistakes. Uh, doesn't entirely understands you [snorts] or kind of misinterprets it or decides to add something extra that wasn't needed at all. So um so AI for sure it's not something that kind of relieves us from thinking. I think it's even uh much more difficult because um previously we were more in this focus zone, right? We were writing code so we were automatically thinking about it and so and now we kind of changed our approach, right? because it's hey clot build me this. M >> so you are not doing anything and suddenly you have to switch the focus mode to make sure that whatever it produced is correct and the urge of just pressing yeah yeah cool merge or pull request or whatever no one cares right no it's it so this this part is really difficult and uh we also saw it because uh AI changed uh so much in the security field and it also kind of surprised us with how quickly because at Patag we really had a lot of conversations about that uh yeah definitely AI will will change how the researchers work. um probably we will at some point get flooded with amount of reports a lot of those things but we were sure we have much more time >> we didn't we didn't and uh I mean we started for example changing the rules of our bug bounty uh if I remember at the start of the year and we really made it much more difficult to submit. So really the the rules are much uh are much stricter and it turns out that uh at some point we really got flooded with AI generated. I mean let's be honest it was just AI slop. >> Mhm. >> I even remember we had our first submission made by open claw. >> Oh god. uh which had a small mistake because um it attached the file that was pointing to local host. So so um but still we were flooded with it. We had to not only change the rules, we had to on the other hand implement a lot of uh AI tooling just to be able to kind of fight with it. >> Mhm. to make [clears throat] to make the texts faster to build the virtual patches faster. So because still patch is a pretty small company. >> Yeah. >> And we have this year already few thousand of reports valid ones. So yeah, it it really changed and and we saw it's it's not only that patch like were hit with it because we saw that word fans had exactly the same problems. They I mean being a researchers I the researcher I totally understand if you can get money for prompting then why not? It's it's exactly the thing. But then yeah, the frontier models and uh the WordPress core vulnerabilities that was uh that was surprising that was surprising that um because for so many years uh there was this narration and I also told it very often that when someone says that WordPress isn't secure, I mean WordPress core is secure, the plugins aren't. Mhm. >> But in total, if I remember, there were five, seven, in total, I think it was five or seven vulnerabilities found with one very severe. >> Mhm. >> And everyone watched this code. I think it it was also kind of the thing that um um I don't want to say that we kind of become lazy or we kind of believed too much in this saying that the core is secure because uh probably no human researchers would find this vulnerability >> right >> yeah but uh or maybe but still it it really changed the the world upside down. And um the thing that we also saw over the years, the time needed for vulnerability to be exploited, it was weeks then days. >> Yeah. >> And uh in our last report we published last year, it was uh five hours if I remember. >> So probably now it's even faster. The problem is that there are much more zero days being discovered. So AI is finding vulnerabilities that no one knows about. >> So and this like especially in the WordPress world, it totally changed the perspective. I mean we already had kind of some of the things uh that we already knew that are that were kind of outdated, right? Like just keep your WordPress up to date and you are safe. We already know it's it's not true. But now we see how much untrue it is because I mean five hours for exploitation was a year ago. So right now I I I really I I can't wait when we start uh because we are just summarizing it once once a year because it's a kind of a lot of data we have to crunch. But uh this number is really fascinating for me to see how much it it changed and um yeah and and also on the other hand we have uh the whole vibe coding thing. >> Mhm. >> Which is which is also a separate thing. [sighs] Uh but uh yeah all those hubs like Lovable, Bald, whatever may I mean they gave so much opportunities to people that would never learn how to code to create their software with a database with payments with everything and it's like a typical question what can go wrong >> right yeah I mean the the thing that I've been saying for most of this year is that like you know give it six months months, give it a year, give it two years. All of those sites that people built like as soon as Cloud Code suddenly got good, they're going to need they're they're not just going to have uh updates that need to be applied. They're going to need those updates applied because there is going to be like security vulnerabilities in, Episode 34: Maciek Palmowski, Maciek Palmowski, 01m34hnszd3hqr08kbez5gfxdr.