Automattic
Making the web a better placeMeet Spacefast, Everything Your Agents Need to Bring Your Ideas to Life
9 Nov 2026, 2:00 pm

Use the AI you already work with to build, publish, and manage apps and website in one place.
Today, your AI can build a working app in an afternoon. Then the setup starts. You pick a host, spin up a database, wire up sign-in, point to a domain, and figure out who gets access. None of that is the fun part.
Spacefast handles all of that for you with your agent, so you can focus on building what you dream up. It’s a new company from Automattic, and it’s open to everyone today.
How it works
Connect Spacefast to your favorite AI, ChatGPT, Claude, Muse, Grok Bot, OpenClaw, Hermes and more. Ask it to put your project on Spacefast. A few seconds later, there’s a link in the chat.
You never have to open a dashboard or leave your editor. Spacefast ships with tool descriptions and instructions written for your agent. It already knows how to deploy or add a database, so you don’t have to explain.
What you get
- Hosting, your own domain, and a SQL database, ready when your project needs them. Built-in app authentication coming soon.
- A new version with every publish, each with its own permanent URL. Roll back anytime, or link to an old build.
- Privacy by default. Share with a password, an invite, a share link, or the whole web.
- An API, a CLI, and an MCP server. If you live in the terminal, run
npx spacefast publish. - Approval checks for sensitive agent actions, such as rollbacks and DNS changes.
- Collaboration tools. Users can comment on any page and pick up where someone else left off. Comment on pages, share feedback, and deliver it right to your agent for updates.
Keep your AI
You keep the agent you already use, along with its memory, context, and files. Spacefast charges for infrastructure, not AI credits, so you don’t pay for inference twice. If you switch AIs next month, your projects stay where they are.
Works with the AI you already use, and knows about you, your work, and your brand. You can use Spacefast with the ChatGPT and Claude apps, as well as personal assistants like Muse, Dots, Claude Duet, Grok Bot, Instinct, OpenClaw, Hermes and coding agents like Claude Code, Codex, Cursor and more seamlessly. Just ask your AI about Spacefast.com.
What people are building
Inside Automattic, teams are making Spacefast part of their everyday work. Our agency team is building dashboards for partners, and a colleague built a tool to review thousands of near-duplicate photos for a website project.
Our teams use it outside. One colleague made a website for the hockey team she coaches, with practice plans, game footage, and the playbook in one place. Spacefast founder Batuhan İçöz built a small app to track the hard drives in his closet.
Built on 20 years of infrastructure
Spacefast runs on the same Automattic infrastructure behind WordPress.com and Tumblr. That infrastructure serves over 15 billion page views a month. You get the same uptime and security that Automattic has offered for 20 years.
Where it came from
Earlier this year, Automattic paused its development roadmaps for Radical Speed Month. Everyone had a month to build something they were passionate about.
Batuhan was on the Beeper team. Nontechnical friends kept sending him projects they’d made with AI and asking for help with GitHub. He thought Automattic’s infrastructure could give those projects a home, so he built a static hosting service on his own.
Users wanted a backend, so he kept building. Spacefast soft-launched in September and became its own company, with Batuhan as founder and CEO.
Try it
Spacefast has a generous free personal plan. Sign up at spacefast.com, or ask your AI to connect. You’ll also find it as an official plugin in the Claude, ChatGPT, Grok Bot, Cursor, Antigravity, and in GitHub’s MCP listing.
Show us what you ship with #MadeWithSpacefast.
Your Sites Are Protected Against the PHP2Shell Vulnerabilities
21 Oct 2026, 4:16 pm
Today, the PHP project released security updates for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), the industry-standard scale for how severe a security flaw is. Anything from 9.0 up is classed as Critical, the highest band. These score that high because they can be attacked over the internet, need no login or action from a site owner, and can give the attacker control of the server: together they allow an attacker to run their own code on it.
If your site is hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, Tumblr, or any Automattic infrastructure, your site is already protected.
Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible. There is nothing you need to do.
If you run PHP yourself, read on.
What happened
PHP is the programming language that powers WordPress and a large share of the web. When PHP handles a request, it sets aside memory to do the work and cleans up afterward. The researchers found that if a request makes PHP fail partway through, for example: by running out of memory while processing a form submission, that cleanup does not happen correctly. Memory gets released while PHP still holds a reference to it, and a later request can reach it.
An attacker who carefully shapes what ends up in that memory can steer PHP into running commands of their choosing. That is the “shell” in PHP2Shell: control of the server.
Three things make this one serious:
- No login is required. The attack works with ordinary web requests.
- Your application does not need a bug. The flaws are in the PHP runtime. Researchers demonstrated working attacks against current WordPress, Drupal, and Joomla installs, and noted that even a minimal “Hello World” page on an affected version can be vulnerable.
- It reaches back a long way. Affected releases go back more than a decade, to PHP 5.4.
What to do if you manage your own PHP
Update PHP. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This is a runtime fix, so updating WordPress, your theme, or your plugins will not protect you on its own. If your host manages PHP for you, ask them to confirm they have applied the update.
If you are on PHP 8.1 or older, plan to move now. The PHP project no longer ships fixes for those versions. Some Linux distributions and long-term support vendors backport security fixes, so check with yours, but the durable answer is a supported release. PHP 8.2 itself reaches end of life on December 31, 2026, so 8.3 or newer is the better target.
If you cannot patch today, reduce your exposure until you can:
- Put the site behind a web application firewall. Several providers, including Cloudflare, have shipped rules for these vulnerabilities.
- If your site does not accept file uploads, block multipart form submissions at the web server, and turn off PHP’s
file_uploadsandsession.upload_progress.enabledsettings. - Watch your logs for unusual multipart requests followed by PHP memory-limit errors or bursts of HTTP 500 responses. Wiz Research lists these as signs of attempted exploitation.
These steps buy time. They are not a substitute for the update.
Thank you
Coordinated disclosure only works when everyone involved does their part. Our thanks to the PHP Security team for their careful work on the fix and the release, and to Wiz Research, Calif, OpenAI, and Quarkslab for finding and responsibly reporting these issues. We were proud to be among the companies Wiz acknowledged for helping prepare guidance and mitigations, and we will keep working with the PHP and WordPress communities to keep the open web safe.
Deflection is Not a Support Strategy
31 Aug 2026, 2:26 pm

Job Thomas is Automattic’s interim Chief Customer Experience Officer.
At the Customer Experience Management Africa Summit in Cape Town, I encountered the same point in several different conversations: AI in support is amplifying a bad pattern, not creating a new one.
Most companies run tiered support. When a customer has a problem, they enter at Tier 1; when it becomes clear their problem is too complex for Tier 1, you’ll move to Tier 2. When all but the final tier is exhausted, the customer finally ends up with the most technical support team.
As a result, the people with the most complex, difficult problems are asked to make the most effort to get help. They have to prove they’ve exhausted all previous options before they are allowed to access our top tier of skilled people.
When AI entered the picture, it didn’t create a new faulty pattern in support—it just highlighted the existing pattern. Many people I’ve encountered are frustrated about getting the right help. Those people often chalk their problems up to a need to “speak to a human,” but that’s not quite it. At heart, they are frustrated that getting the right help is so difficult.
This isn’t an AI problem; it’s a philosophy problem. AI is making the bad philosophy more obvious. As long as a company’s AI deflection rate remains a primary metric for success, that company will end up with frustrated customers. After all, an AI deflection rate isn’t a measurement of customer success—it’s a measure of how good we are at not talking to customers.
We’re not perfect at Automattic. We make mistakes. But our intent is different. We do not approach support by wondering how we might reduce contacts. Instead, we want to know how we might provide a customer with the right help as soon as possible, or maybe even make it unnecessary to ask for help in the first place.
We have a few practices that already reflect these efforts:
- We run quality reviews on our AI assistant every single day. Those reviews focus on how well the assistant helped the customer. (Read more about that here.)
- Our AI assistant knows when to get out of the way. Every time a customer has to ask for a human, we treat that request as a signal that there’s something wrong. (We wrote more about that here.)
- Anyone you reach at Automattic is technically skilled. We do not have tiered support. When a question lands with someone who can’t answer it, that’s a routing failure, not a hurdle we’ve designed.
- We keep our documentation (our AI’s brain) up-to-date, and have mostly automated that process. Here’s a case study for WooCommerce; we have similar initiatives across our product lines.
Improving support starts with a shift in philosophy. If what you want is fewer interactions with customers, AI will deliver that, with fewer negative customer experiences. But if your top concern is providing the right help fast, then you build for the customer.
Do That Which Makes Your Life Easy
18 Aug 2026, 3:30 pm

Elijah Potter, a software engineer who founded and maintains Harper, explores quality of life as a critical decision-making factor. You can read the original post on his blog.
With a relatively small team, David Heinemeier Hansson (DHH), Jason Fried, and 37signals laid the foundation for a number of successful companies and maintained a working community of extremely intelligent engineers. I have long followed their work and benefitted from their advice, which I apply to my own practice.
I recently read Getting Real, 37signals’s guidebook for building a successful SaaS company. Throughout their written work, Fried and DHH bake the same deeply personal idea into their advice: As you build your business or application, set yourself up to have a good quality of life.
Frequently, making decisions in the interest of your own quality of life can also produce better software. If you come to a fork in the road where a decision must be made between two or more options, you can often safely choose the one that improves your own quality of life.
In an older blog post, I proposed a different kind of mental shortcut, one I found effective after imagining what “the most effective engineer” would do in my position. When you imagine yourself on the path to being the kind of person you most admire, I found, you tend to become that person, as if by accident.
Effectiveness and well-being aren’t at odds. Imagining yourself as “the most effective engineer” shouldn’t prevent you from making decisions that improve the quality of your life. Rather, these two shortcuts can be used in tandem.
Eat Your Own Dog Food
When you are required to use your own product—to eat your own dog food, as the saying goes—there’s a strong personal incentive to make your own product better. If you make a change and it improves the quality of your own life, it will almost certainly improve the lives of your users, too.
Here’s an example: Dogfooding, as we know, is a helpful way to identify bugs. If you use your own software, you receive a representative sample of what the experience is like for the average user who consumes your product. When you encounter an obvious bug, you can take steps to address it so your future users won’t.
Which Feature Is Best?
When working on a new feature or capability, it is almost always better to prioritize that which will most tangibly help you.
For me, this meant making Harper available in Discord. At the time, I was using Harper a ton in GitHub. I had grown used to typing out a messy message before hitting Ctrl+E to fix all my mistakes, a strategy that helped me to write code reviews faster. But I felt frustrated whenever I needed to collaborate with a fellow maintainer in Discord because I had to type slower and manually fix my mistakes. By adding Harper to Discord, I improved my own quality of life and introduced a core capability to my product, opening a new market for potential users.
Indirectly Helping Your Users
Sometimes improving your own quality of life is the right call even when it doesn’t directly improve the product experience for your users.
Consider continuous integration. It may take a few minutes to complete, or it may take a few hours. In either case, the wait can be frustrating because it slows everything down.
Now imagine that you must choose between adding a new, highly-requested feature to your product and speeding up your continuous integration. How should you choose to spend your time?
If you believe that speeding up your continuous integration won’t improve your quality of life, then I suggest that you add the new feature instead. However, in my experience, this is rarely the case. Engineers can lose nontrivial amounts of time waiting for their GitHub Actions workflow to complete so they can free up time and space to work on other things. If you have had that experience, then speeding up your continuous integration (or even removing it!) might be the better choice. You’ll move faster, get more done, and, I bet, feel better about the work.
Always Use Your Brain
No matter how many blanket rules you encounter, please use your brain. Sometimes a mental shortcut is the right move, and other times you need to put some real gray matter to work. Each decision should be afforded the consideration it deserves—and learning to assess each situation accurately is an extremely valuable skill.
WRONG AGAIN
12 Aug 2026, 4:40 am
WP Engine’s motion is a desperate attempt to get sanctions and other extreme remedies because Matt used ephemeral messaging in personal communications with romantic partners having nothing to do with this case. Here’s what really happened, as the brief we filed tonight shows:
- We preserved and collected. A litigation hold was issued to our employees, including Matt. We collected over six terabytes of documents. More than 1.5 million documents were reviewed. Five of Matt’s personal devices were forensically imaged, including his Telegram, WhatsApp, and Signal messaging applications.
- Nothing relevant was part of any ephemeral messaging. Our e-discovery vendor collected messages from Matt’s messaging platforms going back to 2012 (Telegram), 2015 (WhatsApp) and 2019 (Signal) through March 2026 — the entire key period in the case and years on either side. WP Engine cannot identify a single missing message about anything having to do with this case.
- They had every chance to find evidence of their accusations. Fact discovery produced more than 225,000 documents and over 114 hours of deposition testimony — including 21 hours of Matt across three days, with three attorneys, more than 80 exhibits, and over 1,300 questions.
Newspack Helps Hong Kong Free Press Protect Its Stories
4 Aug 2026, 8:52 pm
In 2015, following months of pro-democracy protests, Tom Grundy founded Hong Kong Free Press, which bills itself as the city’s “only independent English-language news source.” Since then, Hong Kong has slipped further down the World Press Freedom Index. Free Press journalists navigate “one of the most complicated press-freedom situations in the world,” says Grundy, the site’s editor-in-chief. “The last thing I have the capacity for and am able to worry about is the technology side.”
A few years later, as worrying new security laws took effect, Grundy turned to Automattic’s Newspack for help. The seven journalists at Free Press provide steady, on-the-ground coverage, but they’re not website developers. A bespoke content management system required constant maintenance, and conversations with developers faltered. He worried about site stability and donor engagement, but felt “underprepared and unqualified” for technical conversations. “I needed to speak to tech people who were also aware and understanding of journalistic terminology, and where we come from,” he says.
That year, Grundy began working with Newspack to migrate multiple donation management tools and the Free Press’s content management system to a single platform. “Newspack very patiently worked with me for over a year to get it right,” he says. Through Newspack’s Audience Management tools, the Free Press has developed a greater variety of member benefits, from feature previews and exclusive columns to ad-free browsing, and increased donations by 33 percent.
The security of Free Press’s reporting is a top concern for Grundy, who has seen other newsrooms raided and prominent publications closed. Newspack—which is built on WordPress and hosted by WP Cloud, both Automattic products—has helped “keep the website safe if the worst happens in Hong Kong,” he says. “We have had no downtime.” Last year, when the Free Press was selected for a potentially costly tax inspection, Grundy reached out to Newspack for help putting a targeted fundraising plan in motion. “Within a month, they’d rolled it out to everybody,” he says.
Facing an unstable media landscape, Grundy credits Newspack with keeping Hong Kong Free Press nimble. “I can speak to someone directly who speaks my language, in terms of journalism, and gets things sorted,” he says. “That has liberated me and our news outlet to focus on navigating the red lines and getting the news out.”
Featured Product

Newspack
Leveraging the power of WordPress to help local news organizations serve their communities and find a path to financial sustainability.
newspack.com
Brickomattic: A Celebration of What We Have Built
4 Aug 2026, 12:00 pm

Zach Spears, a Happiness Engineer at Automattic, used our recent Radical Speed Month initiative to finish and ship a project years in the making: Brickomattic, a collection of LEGO® kits that create hangable versions of logos from all of Automattic’s products. Below is Zach’s story of how the project came to be.
This month marks my five-year anniversary at Automattic. As I look ahead to my sabattical with excitement, I can’t help but also look back on my tenure and the incredible things I have been a part of. In a similar fashion, Automattic the organization seems to find itself at a crossroads. We celebrated our 20th anniversary last year, and what it means to be Automattic is changing. We can see these exciting changes with recent acquisitions like Beeper, and changes to how we grow our existing businesses like Automattic for Agencies. As with any remarkable milestone, this is all worth noting and celebrating.
From a young age, I’ve always enjoyed the art of gift-giving; I find that it gives me a way to express my appreciation when words may not come so easily. Over the last five years, I’ve had the opportunity to be part of five different teams at Automattic that touch nearly every part of the business, and to work with incredible colleagues from across the world. Before long, my gratitude for my coworkers combined with my lifelong love of creativity and LEGO® bricks, and I decided to put together some microbuilds.
For my team meetup one year, I used BrickLink’s Studio software to design and organize mini LEGO® rocket kits for my team, which was known as Jupiter. The next year, on a team where we referred to ourselves as pirates. I constructed a small movable pirate ship, complete with custom packaging and instructions. A year later, for a team called Retrograde, I created a small diorama that featured a spaceship against a celestial backdrop.
In addition to the team-specific sets, I wanted to build something more generic for the whole of the company. To do so, I challenged myself to recreate Automattic’s logo in brick form, which I’d never done before. I was really happy with my first design which was intended to sit flat on a desk, and I later adapted it with parts from LEGO® art sets to become suitable for wall hanging. After I shared the design internally, Matt Mullenweg asked if I could build some for the Automattic offices. If you ever find yourself at our offices in San Francisco or New York City, keep an eye out for the logo built from LEGO® pieces!


Once I sent out the finished designs to our offices, I began crafting a series of wall hanging designs for Automattic’s primary products and business units, a process that took several months of slow (but invigorating) iteration and design. Some of the designs came together seamlessly like Day One, and some proved more complicated such as Sensei LMS. The most difficult to figure out was the Woo logo, which is a division I currently work in. I first tried a more minimalist cart design, but eventually came up with a technique to capture the bendy Woo “W.”


Nearly all of the final 20 designs are the same height and width and centered around the LEGO® wall hook-compatible part. This means that they can be displayed as wall art just like the official LEGO® Art sets. I’m proud of how the designs came together, and my personal favorite is the Sensei LMS design, which features the silhouette of a Bonsai tree.
Launching Brickomattic
As the 20 final designs were finally coming together, I needed a way to share to share them with my colleagues that felt more like an art gallery than a blog post. I also wanted the kits to feel three-dimensional the way a physical set would, and to experience the joy of the kit coming together, as it would in a LEGO® video game.
And so: Brickomattic.
I launched a WordPress.com site, grabbed the domain brickomattic.com, and began building. With assistance from generative coding tools, I was able to implement a fully featured and inviting gallery complete with self-constructing 3D models and an x-ray button. I also designed and exported building instructions and high-resolution renders of the designs. The site uses a library of parts from LDraw and LDR export files from the Studio software to build the immersive gallery. I’m currently working on adapting this plugin into an open-source WooCommerce plugin for MOC (“My Own Creation,” a term for custom-designed models) sellers in the broader AFOL (Adult Fans of LEGO®) community.
Why LEGO®?
At Automattic we like to say that code is poetry. This looks great on a T-shirt, but it’s also an expression of a broader philosophy. We approach what we create as a business with thought and intention. From that standpoint, it’s not much of a stretch to draw a line to the LEGO® artform; both take small parts and combine them to create something worth being proud of.
It’s also fair to point out that I’m a lifelong LEGO® fan, and this was something that I did for myself. I love creating, and I love sharing the things that I create with others. Brickomattic is as much an act of play as it is a gift to my coworkers. It forced me to step outside of my comfort zone and build things I didn’t think I was capable of.
Finally, I have a strong belief in the value of the tangible. As a business that builds software, and that works distributed, we can sometimes feel disconnected from our work. This is why meetups and team swag are important to our culture: They foster a feeling of belonging. Creating a physical representation of the software you work on every day is an important physical reminder of the things you build and the impact that they (and you) can have.
Women at Work: A Podcast for Creatives on a Platform for Creatives
27 Jul 2026, 3:00 pm
Verònica Fuerte is the founder and “creative directress” of Barcelona’s Hey Studio, where her team builds visual languages for clients and projects around the world. When she looks at the design industry, she sees something that’s always been true but too often overlooked: Women have been shaping it all along, they just haven’t always gotten the credit.
That observation became the seed for Women at Work, a podcast dedicated to amplifying the voices of female creatives across design, creativity, and innovation. The premise is simple but powerful. “If you listen to somebody that made it happen,” Verònica says, “you can have the same experience. You can follow the same path. It’s just about having examples of other people.”
The podcast’s next step was, as Verònica puts it, organic. Hey Studio’s website has always run on WordPress, so when Women at Work grew enough to need its own digital home, the choice of destination was clear. And while she has long appreciated the ease of open source software, WordPress’s longevity made her decision even simpler. “I know that WordPress is going to be forever,” she says. “So I think it makes my life easier in many, many aspects.”
The site brings everything Women at Work is about—episodes, guest stories, and its broader mission—into one place, and gives the project a professional presence that matches the quality of the conversations themselves.
But Verònica is thinking bigger than episodes and archives. “A podcast is a community,” she says. “And I think how this community can be seen is part of the future.” With WordPress.com as the foundation, Women at Work is building toward exactly that: a growing platform that helps the next generation of creatives see themselves in the industry—and in each other.
Featured Products

Jetpack
Security, performance, and marketing tools made for WordPress sites by the WordPress experts.
jetpack.com

WordPress.com
Everything you need to build and grow any website—all in one place.
WordPress.com

Akismet
Akismet’s advanced AI filters out comment, form, and text spam with 99.99% accuracy, so you never have to worry about it again.
akismet.com
Lights, Camera, ‘Code for the People’
13 Jul 2026, 4:15 pm
Over the past two decades, open source software has powered much of the internet’s infrastructure. Technologies like WordPress—which powers more than 40% of the web—demonstrate the impact of a model built on global collaboration and shared knowledge.
Now, though, the open web is facing an inflection point. As a handful of digital landlords and closed AI systems threaten to replace a free and open internet with algorithmic walled gardens, those of us fighting for an open-source future need to stick together.
To tell this story, Automattic partnered with acclaimed director Bao Nguyen on a new documentary short, Code for the People. The film explores this critical breaking point and serves as a rallying cry to reclaim the open-source spirit before the future of the internet is decided for good.
At a time when AI and digital platforms are redefining the rules of the internet, Code for the People invites audiences to engage in a conversation that extends beyond software. The documentary argues that the future of the web will depend on the choices the technology community makes today, positioning open source as a strategic foundation for building a more resilient, transparent, and decentralized digital infrastructure.
Earlier this month, Code for The People partnered with Variety and KQED to hold premiere screening events in New York City and San Francisco. The panels and discussions that followed made one thing obvious: These aren’t niche concerns. They’re questions that matter to anyone who builds, creates, or publishes online. Check out the full documentary above, and experience the premiere screenings through the gallery below.



















Automattic Celebrates Graduates of University of Illinois Chicago’s AI Leaders Program
23 Jun 2026, 4:00 pm

On June 23, around 40 students from Illinois and Louisiana will wrap up the year at University of Illinois Chicago (UIC) as the first graduating cohort of AI Leaders—the nation’s first workforce-focused AI literacy course tied to a recognized credential.
These students built real WordPress projects. They applied generative AI to real work. For example, Stephen Poole completed the Ultimate Success track and posted a reflection after every session, and shipped his portfolio at stefanpoole.dev. Another student, Sharaheel Ali, finished WordPress 1–8 and launched sharali.blog, framing his portfolio around WordPress support engineering, cybersecurity, and AI. They earned a micro-credential backed by UIC and the WordPress Foundation. And those who completed the course also earned $1,000. Automattic is proud that we joined the University of Illinois Chicago (UIC) to make a donation to UIC Tech Solutions Open Source Fund earlier this year.
Built on Open Source
AI Leaders works because it’s built on open source. Students learn on WordPress, which powers more than 40% of the web, and contribute back to it. They use generative AI as a tool and leave with a credential employers can verify. The community they build while contributing to WordPress remains long after graduation.
At Automattic, we believe deeply in open source; it’s the ethos that built the web. We think it should help build the next generation of AI-literate workers too—in the open, accessible to all, and with full ownership of the work they do.
Bigger Things are on the Horizon
AI Leaders is just one piece of Automattic’s broader investment in education. We’ve pledged $500 million worth of hosting accounts over the next five years to support open source learning, workforce development, and the next generation of contributors to the web.
We’re investing in this because access to AI and open source skills shouldn’t depend on where you live or what you can afford. The first cohort proves the model works. Now we want to help it grow
What’s Next
Prospective employers and agencies will attend a graduation party in Chicago to meet the students, and more job placements are in motion. The next round of AI Leaders is on the horizon; we’ll share application details for that soon. And to the inaugural AI Leaders cohort: congratulations. The web is what we make it, and we’re excited to watch you shape that legacy.
Page processed in 0.567 seconds.












