Mullenweg Asked If He’s Adaptable To Change via @sejournal, @martinibuster

Matt Mullenweg, co-creator of WordPress, recently held a question-and-answer session at WordCamp Asia 2025, where he faced several tough questions. Topics included whether he was open to discussing change, the steep learning curve of WordPress, and whether he would reconsider reducing Automattic’s contributions to WordPress core.

As tough as those questions were, Matt answered each of them gracefully and focused on staying positive, even when he was saying no.

Mullenweg Says Being Adaptable To Change Is Important

In one of these exchanges someone asked what WordPress would be like in five years and he couldn’t answer it. He explained it that not having a plan beyond Gutenberg was essentially a feature and not a bug, explaining that a shorter term perspective is good for staying agile in a rapidly changing technological environment.

He said:

“Outside of Gutenberg, we haven’t had a roadmap that goes six months or a year, or a couple versions, because the world changes in ways you can’t predict.

But being responsive is, I think, really is how organisms survive.

You know, Darwin, said it’s not the fittest of the species that survives. It’s the one that’s most adaptable to change. I think that’s true for software as well.”

Change Is Not Coming To WordPress

In a seeming about face about the importance of WordPress being adaptable to change, Matt Mullenweg drew the line at being adaptable to change when it comes to governance.

Taco Verdonschot (LinkedIn profile) stood up to ask the question.

“I’m Taco, co-owner of Progress Planner. I was wondering, you were talking about adaptability before and survival of the fittest. That means being open to change. What we’ve seen in the last couple of months is that people who were talking about change got banned from the project. How open are you to discussing change in the project?

Matt answered:

“Sure. I don’t want to go too far into this but I will say that talking about change will not get you banned. There’s other behaviors… but just talking about change is something that we do pretty much every day. And we’ve changed a lot over the years. We’ve changed a lot in the past year. So yeah. But I don’t want to speak to anyone personally, you know. So keep it positive.”

Calls For Change In Governance

There have been many high profile calls for a change in how WordPress is governed, most notably by Joost de Valk, the creator of Yoast SEO software and currently a co-owner of the Progress Planner WordPress plugin.

Joost had written:

“A lot has happened over the last few months, that I think all comes down to the above. I’ve often considered how the WordPress world “worked” unhealthy. I’ve spoken to many slightly outside of our industry over the past months about what was happening and several people, independent of each other, described WordPress as “a cult” to me. And I understand why.

I think it’s time to let go of the cult and change project leadership. I’ve said it before: we need a “board”. We can’t wait with doing that for the years it will take for Automattic and WP Engine to fight out this lawsuit. As was already reported, Matt said recently in Post Status that “it’s hard to imagine wanting to continue working on WordPress after this”. A few days later, he gave a completely conflicting message in the State of the Word. Yet he never came back on that first statement or clarified that he’d changed his mind. He also didn’t come back to talk to the community he turned his back on.”

Joost de Valk was supposed to speak at WordPress Asia 2025 but the co-owner of Progress Planner was there and asked the hard question.

Mullenweg Challenged To Adapt To Change

His statement about being adaptable to change set up another awkward moment at the 6:55:47 minute mark where Taco Verdonschot, co-owner of Progress Planner, stood up to the microphone and asked Mullenweg if he really was committed to being adaptable.

Taco Verdonschot is formerly of Yoast SEO and currently sponsored to work on WordPress by Emilia Capital (owned by Joost de Valk and Marieke van de Rakt).

Taco asked:

“I’m Taco, co-owner of Progress Planner. I was wondering, you were talking about adaptability before and survival of the fittest. That means being open to change. What we’ve seen in the last couple of months is that people who were talking about change got banned from the project. How open are you to discussing change in the project?”

Mullenweg responded:

“Sure. I don’t want to go too far into this but I will say that talking about change will not get you banned. There’s other behaviors… but just talking about change is something that we do pretty much every day. And we’ve changed a lot over the years. We’ve changed a lot in the past year. So yeah. But I don’t want to speak to anyone personally, you know. So keep it positive.”

Featured Image by Shutterstock/StarLine

Does WordPress Need Another Site Building Tool? Builderius Thinks So. via @sejournal, @martinibuster

A newly released page builder plugin called Builderius elicited enthusiastic feedback in a private WordPress Facebook group. A conversation with one of its principals, Elvis Krstulović, underscored how WordPress’s open source flexibility allows developers to rethink site building itself, creating tools that prioritize flexibility, maintainability, and professional development practices.

Is Builderius A Page Builder?

I saw a discussion in a private WordPress Facebook group called Dynamic WordPress and reached out to one of the developers to learn more. The interview is as much about how WordPress inspires people to create new and interesting products as it is about Builderius.

What is Builderius, is it a page builder?

“Yes, Builderius is a page builder but it’s also a developer tool. We prefer to call it a visual development environment. This name better captures what Builderius actually does – it brings powerful web development practices into a visual, easy-to-use interface. Instead of just decorating content with visual elements, Builderius helps you build websites the way professional developers do, but without the steep learning curve.

Builderius brings professional development workflows right into WordPress. Things like version control and staging environments – which normally require technical knowledge – are simplified into intuitive buttons and workflows in your admin panel. You get all the benefits of professional development practices without needing to learn complex systems like Git or server management.”

How Designing A Site With Builderius Works

I next asked how designing a site with Builderius works, what it’s like in a general sense.

Krstulović answered:

“All the work a Builderius user is doing is completely invisible outside on the live site until that work has been saved AND published as a public release. This means, for instance, that you can safely work on a busy live website, and nobody will know. Even if you make a mistake in Builderius, you will be the only one to know. When the work you have done is finished and signed off, you click a button and that site feature, redesign whatnot, is live for everyone to see and use.

Releases are small packages that contain JSON and some assets used in the Builderius environment and nothing else, so the processing of moving a release from dev to prod branch is mostly super quick. This means no site downtime even for major rework. It also means safe and easy rollback. Just go back to previous release, and you are back to where you were.”

Minimal And Flexible Approach To Styling A Website

Krstulović next described their design philosophy with their page builder:

“Builderius is built on good development principles that make websites more maintainable and easier to update. For example, we keep content separate from styling – a professional approach that makes websites easier to manage as they grow. If you have an element used across the website, you can easily change how it looks without having to rebuild it at each instance, since the data, the markup and styling are independent.

For example, we do not ship elements (like Elementor widgets) called for instance “post title”. We give the user an agnostic “html container” which can be any HTML element, a single one or a more complex combination of elements, which you can then link to any dynamic data via our dynamic data tags. You can pick these from a pop-up living near any content input, or HTML attribute input.

So to make a post title, you would add a heading, and then link it to post title data tag. It’s a step more, but it makes everything way more minimal and flexible at the same time. You can then swap the markup with anything, change the data it shows… and so much more.

When it comes to styling, Builderius gives you complete freedom. Unlike other page builders that limit what CSS selectors you can use, we let you write any selector right in the interface. For example, when styling the “post content” from within the Builderius template, you can target post content child elements using logical/compound CSS selectors – and not via custom code.

We ship with an our open-source CSS framework, choosing this approach over theme settings or presets because frameworks are more modular and flexible. You can remove parts you don’t need or bring your own framework if you prefer.”

Who Is This Page Builder For?

A lot of the people in the Dynamic WordPress Facebook group who are excited about this page builder are advanced web developers who build sites for clients. So I asked him if that’s who their end users are or if it’s appropriate for businesses looking for drag and drop solution?

Krstulović answered:

“We believe it provides different benefits for different user groups. For a front-end developer who is struggling with a sometimes messy WordPress development experience, it provides a clean and organized workflow, what developers expect from modern web dev. And it makes it faster. Frontend tasks are handled with visual tools and data is pulled into place with convenient data tags.

For aspiring web builders that want to learn and advance in their craft, it is an easier way into this demanding field. It is easier because visual tools are generally easier for most people, and because Builderius does so much for the user in terms of organizing the development process, from the version tracking and all that, to compiling code, and handling templating.

For developers that care about accessibility, Builderius offers ultimate control over every aspect of HTML.

Builderius is not for everyone. It is most certainly not for a business looking for a simple drag and drop solution, and it’s not for someone whose primary goal is to make things easy to do without understanding them.

But for developers who care about details, who get frustrated by limitations of tools that make them bend the design around the tool rather than the other way around, Builderius might just be for them.

If a user takes time to learn the tool, they’ll be able to build super fast, and exactly the way they’re asked to. And maybe even more importantly, if you learn Builderius you can take that knowledge elsewhere. No proprietary names, weird workarounds, just visual web development.”

Why Use Builderius Instead Of Gutenberg Blocks?

I next asked why someone would choose to use Builderius over the WordPress native Gutenberg blocks. Does it expand creative freedom or simplify the site building experience?

Krstulović answered:

“The answer is yes. Builderius provides more freedom to you as a developer or a site builder, and less freedom for the person who might use that freedom to break things, through website management roles. Developers provide development, and content people provide content.

For the creatives out there: When Builderius takes control of a page, it removes all that WordPress has put there that has to do with its scope of work. It removes various assets, the HTML, all. For instance, block CSS is gone. In return, you get a clean slate where you have nothing to override. You can use the least specific CSS possible and it will work. This means you can use some completely non-WP CSS library without fear it will interfere with WordPress stuff. It is super free, and super tidy.

This approach actually makes site building simpler in the long run. While blocks are great for quick layouts, they can become complicated when you need something specific. You might end up hunting through JSON settings, searching for hidden options, or even writing custom React code.

With Builderius, there’s a clearer path. Everything is where you’d expect it to be, following the same patterns that professional web development uses.

It also starts a bit more steep, but as you progress, site building becomes simple and quicker to do.

For example, you can easily build your own blueprint, save it as release, and pull that in at every site build start. This can have whatever you want inside, an extended CSS framework, custom components, custom template wireframes… and more.

And each and every aspect remains editable to be completely changed if you so desire. Flexibility, precision and control of the process.”

What Expectations Should Users Have?

Builderius is a 1.0 version software.  So I asked Krstulović what a reasonable expectation would be for Builderius. Krstulović answered that the page builder is a beta version but a very functional one.

He answered:

“This is in fact a version 1.0 beta of the Free version of Builderius. So we are at the very start.

But this does not mean it’s not to be used or that it can do very little. We believe that the Free version serves an important role in the future adoption of Builderius. Its role is to expand the ecosystem, and make the builder more widely used, tested, integrated with other tools etc.

We’ve carefully designed the Free version to be genuinely useful for real projects, not just a demo. We wanted to find the right balance where it has enough features to build professional websites while still reserving some advanced capabilities for the paid version.

Builderius Free is built to be a very elegant builder for building fairly simple websites in terms of scale and dynamic data complexity, but also for those websites that are rigorous with regard to styling control, accessibility, performance and so on.

In short, if you can build the site with ACF or Metabox simple fields (so no repeaters and similar), with default posts and pages, and loop those posts on the templates that employ the main WordPress query (Archives, Search results, Blog index), you can build it with the free version.

So do not expect to loop over remote data just yet. Do not expect to modify the template rendering based on user interaction, or URL parameters… not in the free version. But if it’s a simple site, and you want to make it professionally, Free might be a good fit.

We also have some bugs to squash during this beta period, of course.”

Takeaways

What I learned from this interview is that Builderius is a developer-focused page builder that’s more accurately described as a visual development environment rather than a drag-and-drop tool. It also integrates professional development workflows like version control and staging directly into WordPress. So for that reason, Builderius is not designed for businesses looking for a simple drag-and-drop solution. It’s more for front-end developers who appreciate a structured, efficient workflow within WordPress.

Available At The WordPress.org Repository

If you’re interested in Builderius it’s now available for download at the official WordPress.org Plugin repository.

Read more about Builderius at the Builderius.io website.

Featured Image by Shutterstock/RSplaneta

Analysis Forecasts More Vulnerabilities In 2025 via @sejournal, @martinibuster

A new analysis predicts that the number of reported vulnerabilities will reach record highs in 2025, continuing the trend of rising cybersecurity risks and increased vulnerability disclosures.

Analysis By FIRST

The analysis was published by the Forum of Incident Response and Security Teams (FIRST), a global organization that helps coordinate cybersecurity responses. It forecasts almost 50,000 vulnerabilities in 2025, an increase of 11% over 2024 and a 470% increase from 2023. The report suggest that organizations need to shift from reactive security measures to a more strategic approach that prioritizes vulnerabilities based on risk, planning patching efforts efficiently, and preparing for surges in disclosures rather than struggling to keep up after the fact.

Why Are Vulnerabilities Increasing?

There are three trends driving the increase in vulnerabilities.

1. AI-driven discovery and open-source expansion are accelerating CVE disclosures.

AI is vulnerability discovery, including machine learning and automated tools are making it easier to detect vulnerabilities in software which in turn leads to more CVE (Common Vulnerabilities and Exposures) reports. AI allows security researchers to scan larger amounts of code to quickly identify flaws that would have gone unnoticed using traditional methods.

The press release highlights the role of AI:

“More software, more vulnerabilities: The rapid adoption of open-source software and AI-driven vulnerability discovery has made it easier to identify and report flaws.”

2. Cyber Warfare And State-Sponsored Attacks

State-sponsored attacks are increasing which in turn leads to more of these kinds of vulnerabilities being discovered.

The press release explains:

“State-sponsored cyber activity: Governments and nation-state actors are increasingly engaging in cyber operations, leading to more security weaknesses being exposed.”

3. Shifts In CVE Ecosystem

Patchstack, a WordPress security company, identifies and patches vulnerabilities. Their work is adding to the number of vulnerabilities discovered every year. Patchstack offers vulnerability detection and virtual patches. Patchstack’s participation in this ecosystem is helping expose more vulnerabilities, particularly those affecting WordPress.

The press release provided to Search Engine Journal states:

“New contributors to the CVE ecosystem, including Linux and Patchstack, are influencing disclosure patterns and increasing the number of reported vulnerabilities. Patchstack, which focuses on WordPress security, is playing a role in surfacing vulnerabilities that might have previously gone unnoticed. As the CVE ecosystem expands, organizations must adapt their risk assessment strategies to account for this evolving landscape.”

Eireann Leverett, FIRST liaison and lead member of FIRST’s Vulnerability Forecasting Team, highlighted the accelerating growth of reported vulnerabilities and the need for proactive risk management, stating:

“For a small to medium-sized ecommerce site, patching vulnerabilities typically means hiring external partners under an SLA to manage patches and minimize downtime. These companies usually don’t analyze each CVE individually, but they should anticipate increased demands on their third-party IT suppliers for both planned and unplanned maintenance. While they might not conduct detailed risk assessments internally, they can inquire about the risk management processes their IT teams or external partners have in place. In cases where third parties, such as SOCs or MSSPs, are involved, reviewing SLAs in contracts becomes especially important.

For enterprise companies, the situation is similar, though many have in-house teams that perform more rigorous, quantitative risk assessments across a broad (and sometimes incomplete) asset register. These teams need to be equipped to carry out emergency assessments and triage individual vulnerabilities, often differentiating between mission-critical and non-critical systems. Tools like the SSVC (https://www.cisa.gov/ssvc-calculator) and EPSS (https://www.first.org/epss/) can be used to inform patch prioritization by factoring in bandwidth, file storage, and the human element in maintenance and downtime risks.

Our forecasts are designed to help organizations strategically plan resources a year or more in advance, while SSVC and EPSS provide a tactical view of what’s critical today. In this sense, vulnerability forecasting is like an almanac that helps you plan your garden months ahead, whereas a weather report (via EPSS and SSVC) guides your daily outfit choices. Ultimately, it comes down to how far ahead you want to plan your vulnerability management strategy.

We’ve found that Boards of Directors, in particular, appreciate understanding that the tide of vulnerabilities is rising. A clearly defined risk tolerance is essential to prevent costs from becoming unmanageable, and these forecasts help illustrate the workload and cost implications of setting various risk thresholds for the business.”

Looking Ahead to 2026 and Beyond

The FIRST forecast predicts that over 51,000 vulnerabilities will be disclosed in 2026, signaling that cybersecurity risks will continue to increase. This underscores the growing need for proactive risk management rather than relying on reactive security measures.

For users of software like WordPress, there are multiple ways to mitigate cybersecurity threats. Patchstack, Wordfence, and Sucuri each offer different approaches to strengthening security through proactive defense strategies.

The main takeaways are:

• Vulnerabilities are increasing – FIRST predicts up to 50,000 CVEs in 2025, an 11% rise from 2024 and 470% increase from 2023.
• AI and open-source adoption are driving more vulnerability disclosures.
• State-sponsored cyber activity is exposing more security weaknesses.
• Shifting from reactive to proactive security is essential for managing risks.

Read the 2025 Vulnerability Forecast:

Vulnerability Forecast for 2025

Featured Image by Shutterstock/Gorodenkoff