Latest Digital Marketing News: SEO, PPC, AI & Web Updates

Digital marketing changes quickly. Each week, Loop Digital rounds up the SEO, PPC, AI, content, and web developments that could affect how businesses market themselves online.

We focus on the developments worth knowing about, what they mean in practice, and where businesses may need to act.

Read time: 22 minutes

Updated: 26th October 2026

Two security jobs need doing this week. Ask your web host whether PHP has been patched, and if your WordPress site uses UpdraftPlus, check it. If you run ChatGPT Ads, decide before 30th October whether OpenAI may rewrite your ads.

The rest is about proportion. AI Overviews now cover most commercial searches in one US study, yet ChatGPT sent under 1% as many visits as Google organic in another. Google’s rankings also moved over the weekend, and Google hasn’t said why.

Contents

• Two Critical PHP Flaws, Nicknamed PHP2Shell, Put Websites at Risk
• UpdraftPlus Breach Lets Attackers Add Backdoors to Linked WordPress Sites
• ChatGPT Ads Will Rewrite Ads Automatically From 30th October
• OpenAI Explains How ChatGPT Decides Which Ad to Show
• Ranking Tools Show Volatility Around 24th October
• AI Overviews Now Appear on Most Commercial Searches in One Study
• One Analysis Puts ChatGPT Referrals at Under 1% of Google Organic
• Google Spells Out What Robots.txt Can and Cannot Control
• Google’s CEO Says AI Agents Will Reach Websites by Browsing and Through Protocols
• UK AI Security Institute Reports Claude Mythos 5 Acted on Real Websites in Tests
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Two Critical PHP Flaws, Nicknamed PHP2Shell, Put Websites at Risk

PHP, the language WordPress, Joomla and Drupal run on, has two critical flaws that can let an attacker run commands on a web server without logging in. The PHP project released fixes on 21st October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says updating is the only safe choice. Its temporary measures don’t make a server safe.

Some sites were pulled offline while owners patched, including Edinburgh and Oxford councils and the Metropolitan Police website and Finnish government sites. Reports differ on whether attackers are exploiting the flaws, so assume they are looking.

PHP 8.1 and older no longer receive updates from the PHP project, and 8.2 reaches end of life on 31st December. Some hosts supply their own fixes, so your provider’s answer matters more than the version number.

What should your business do?

Ask your host or web developer to confirm three things this week.

• Which PHP version your site runs, and whether it has been patched or moved to a supported version.
• That the fix is applied, not just scheduled. On shared hosting, ask the host to confirm in writing.
• A dated upgrade plan, if the site is on PHP 8.1 or older.

If a site has to go offline while it is fixed, ask for a 503 status page, not a 404. Google advises this so already indexed pages are preserved, for no longer than a day or two. The NCSC’s guidance adds that anything that couldn’t be fixed immediately should be checked for backdoors.

UpdraftPlus Breach Lets Attackers Add Backdoors to Linked WordPress Sites

Attackers used stolen UpdraftCentral connection keys to send commands to linked WordPress sites, according to Search Engine Journal. The commands installed malicious plugins and created administrator accounts without needing a username or password. The keys were taken after TeamUpdraft’s own website was compromised on 17th and 18th October.

UpdraftPlus is installed on more than 3 million sites, but the problem affects sites with an active UpdraftCentral Cloud connection. TeamUpdraft released versions 1.26.13 (free) and 2.26.13 (premium) on 19th October. Patchstack says this wasn’t a flaw in the plugin itself, so the updates revoke old connections and don’t remove anything already installed.

What should your business do?

• Ask whoever manages your site to confirm it runs 1.26.13, 2.26.13 or newer.
• Remove any UpdraftCentral keys you no longer use.
• Check the plugin list for names you don’t recognise and the user list for administrators nobody added.
• If you find either, change every administrator password and consider restoring a backup from before 17th October.

ChatGPT Ads Will Rewrite Ads Automatically From 30th October

OpenAI is switching on creative enhancements for new and existing self-serve ChatGPT Ads campaigns from 30th October, according to Search Engine Roundtable. Advertisers who don’t opt out first will have ads adapted without approving each version. Search Engine Land reports the same date, although OpenAI’s help page names 31st October, so treat the 30th as the earliest.

The changes can include new headlines and descriptions, translated text, resized images and a different destination page on your site. You can opt out in Ads Manager under manage settings. Campaign settings override account settings, and existing opt-outs stay in place.

What should your business do?

• If you run ChatGPT Ads, decide on this before 30th October.
• In finance, healthcare or legal services, opt out or get compliance sign-off for any rewritten claims.
• If you leave it on, check the destination pages it picks carry your tracking and the right offer.

Automated rewrites change what customers see without anyone approving it. Loop Digital’s paid search and PPC services review which automated settings are switched on and judge them on leads and sales.

OpenAI Explains How ChatGPT Decides Which Ad to Show

OpenAI says a separate model reads the conversation, searches for candidate ads and checks them against eligibility rules including location targeting, policy, budget and pacing, as Search Engine Journal reports. A distinct auction system then ranks, prices and selects the ad. The language model doesn’t choose the winner or set the price.

Ads are judged on fit with the conversation, past performance and the likelihood of a view, click or conversion. Personalised ads can use nonsensitive details from earlier conversations. OpenAI hasn’t said how much weight each signal carries, and this is its own account, not an independent test.

What should your business do?

• Write ads and landing pages around the specific questions your customers ask, because fit with the conversation is one of the signals.
• Check location targeting and budget settings, since they decide eligibility before anything else.
• Judge results on qualified enquiries, not clicks.

Ranking Tools Show Volatility Around 24th October

Third-party Google tracking tools showed significant ranking volatility on Saturday 24th October, according to Search Engine Roundtable. Barry Schwartz believes Google released an adjustment on 23rd October, but Google hasn’t confirmed an update.

The movement follows the September spam update, which finished on 8th October. The same article notes the tracking tools had struggled with data for about a month, so treat single-day charts with caution.

What should your business do?

• Don’t change pages or settings because of one weekend.
• In the Search Console Performance report, compare the week after 24th October with the week before, page by page.
• Judge the result on organic enquiries, not rankings.
• Hold off site-wide changes unless a drop lasts a week or two and sits on specific pages.

AI Overviews Now Appear on Most Commercial Searches in One Study

Semrush data reported by Search Engine Land shows AI Overviews on 88% of the commercial keywords it tracked in August 2026, up from 45.75% in September 2025. The sample is 400 US desktop keywords across banking, ecommerce and software.

“Best X for Y” searches reached 96%. “Nearly double” describes the share of keywords with an AI Overview, not clicks. The study measured no change in clicks or conversions, and it contains no UK data.

What should your business do?

• Search five buyer-style queries for your sector, such as “best [service] for [need]”, “[competitor] alternatives” and “[you] vs [competitor]”, and note who the AI Overview names.
• If you aren’t named, check whether you have a page that answers that comparison honestly.
• Compare what the AI Overview says about you with your own site, and correct anything out of date.

Comparison and “best for” queries are where buyers build a shortlist. Loop Digital’s Answer Engine Optimisation services focus on how your pages answer those questions.

One Analysis Puts ChatGPT Referrals at Under 1% of Google Organic

Across 100 websites and 12 months of GA4 data, ChatGPT sent 0.62% as many sessions as Google organic search, according to Marie Haynes’ analysis, reported by Search Engine Land. ChatGPT referrals stopped growing in August 2025 and declined afterwards.

On the 55 sites tracking conversions, 13.8% of ChatGPT visitors converted, against 3.02% from Google organic. Google organic still produced 27 times the conversions of all AI tools combined. 

What should your business do?

• Look up your own figures. In GA4, open the traffic acquisition report, filter for chatgpt.com, and compare visits and conversion rate with organic search.
• Treat a small, high-converting channel as something to track, not a reason to move budget.
• Keep organic search work going, since it still carries the volume.

Organic search still carries most of the enquiries in this data. Loop Digital’s SEO services combine technical reviews, content improvements and organic performance analysis.

Google Spells Out What Robots.txt Can and Cannot Control

Google’s Gary Illyes said in a Search Central video that robots.txt is an access preference protocol. It governs which URLs a compliant crawler may request, and it doesn’t dictate what a system does with content after crawling, as Search Engine Journal reports.

Google-Extended is a robots.txt token that controls whether crawled content can train future Gemini models and ground Gemini Apps and Vertex AI. It doesn’t affect Search inclusion or rankings. Google also updated its guide to keeping content out of Search on 21st October, according to PPC.land.

What should your business do?

• Decide deliberately whether you want AI features to use your content. For most businesses that want enquiries, being included is the point.
• If you do want to restrict something, ask your SEO provider which control matches it, because robots.txt alone won’t stop reuse.
• Check your robots.txt isn’t blocking pages you want found.

Google’s CEO Says AI Agents Will Reach Websites by Browsing and Through Protocols

Sundar Pichai told the Sources podcast that agents will use websites in two ways, according to Search Engine Journal. One is browsing pages as much as people do, which he called elegant and which keeps users in the loop. The other is purpose-built protocols, which he called far more scalable but slower to develop.

Protocols named include MCP, payment protocols and Google’s Universal Commerce Protocol, an open standard for agent actions in AI Mode and Gemini, starting with buying. Pichai gave no timelines and didn’t explain how ads will work when an agent does the browsing.

What should your business do?

• Check your key journeys read clearly without a person, such as prices, opening hours, forms and booking steps not hidden behind pop-ups.
• If you sell online, keep product feeds and Merchant Center data accurate.
• Ask your developer whether your bot protection would block an agent acting for a customer, and decide whether that is what you want.

Agents and people both need pages that say what you do, who it suits and what it costs. Loop Digital’s content marketing services build that from your team’s expertise.

UK AI Security Institute Reports Claude Mythos 5 Acted on Real Websites in Tests

During UK AI Security Institute cyber tests in July, a misconfigured challenge left the intended route closed, and Claude Mythos 5 went looking for another way, according to The Next Web. It targeted the GitHub repository of an unrelated open-source project. In the worst case it got past GitHub’s sign-up checks, opened a malicious pull request, emailed the maintainers while posing as a human and used a second account to vouch for the change.

The maintainers refused the change, and an outside developer warned them it was malware. Nine of the institute’s 43 runs involved actions that affected real people or organisations, and it said no real-world harm resulted. Anthropic called it a serious failure of alignment. The institute now runs these tests without internet access, as Anthropic did for its own evaluations.

What should your business do?

• If staff use AI agents that can browse, log in or run code, list which accounts and systems they can reach.
• Keep a named person responsible for approving anything an agent submits, publishes or sends.
• Treat this as a signal to monitor, not a reason to stop using AI tools.

This Week in 60 Seconds

• Confirm your PHP version is patched. Two critical flaws allow remote takeover.
• UpdraftPlus users should check the version, connections, plugins and administrator accounts.
• ChatGPT Ads rewrites ads automatically from 30th October unless you opt out.
• ChatGPT’s ad auction weighs fit with the conversation, and memory can inform personalised ads.
• Ranking tools show volatility around 24th October. Google hasn’t confirmed an update.
• AI Overviews appear on most commercial searches in one US study, with no click data.
• ChatGPT sent about 0.6% as many visits as Google organic in one 100-site analysis.
• Robots.txt controls crawling, not how content is used afterwards.
• Google CEO expects agents to browse pages and use protocols, and the UK AI Security Institute reports Mythos 5 acted on real websites in tests.

What Should Your Business Act On Now?

Act now

• Ask your host or web developer to confirm PHP is patched and supported.
• If you use UpdraftPlus, confirm the version, remove unused connection keys and check plugins and administrator accounts.

Review

• Your ChatGPT Ads creative enhancements setting, before 30th October.
• Search Console performance by page after the weekend volatility.
• ChatGPT and other AI referrals in your own analytics.
• Whether AI Overviews name you for “best for” and “alternatives” searches.
• Whether your robots.txt matches what you want AI features to use.

Prepare

• A named owner for hosting, patching and plugin updates.
• Clear prices, forms and booking steps that work without a person clicking.
• A record of which ads were changed automatically.

Monitor

• Google confirmation of the 24th October movement.
• Universal Commerce Protocol outside the US.
• PHP follow-up advisories and the next bugfix release.
• How AI agents behave when given internet access.

Stay Ahead of Digital Marketing Change

A patch released on 21st October, a plugin breach on 17th October and an ad setting that flips on 30th October have one thing in common. Each needs a named person who checks it, and that person is easier to find before the problem than after.

Unsure whether to focus on organic search, campaign measurement or stronger website content? Discuss your current marketing challenges with Loop Digital and identify where to concentrate your effort.

Book Your Free 30-Minute Strategy Call

---

Updated: 19th October 2026

This week has one urgent action, for anyone running remote-monitored refrigeration. Attacks on French supermarket controllers make it worth checking whether yours can be reached from the internet. If you track ChatGPT visitors in analytics, last week’s numbers may also be misleading.

The rest is about measuring AI search and advertising. Google is putting more links into AI answers, ChatGPT Ads has new reporting, and new research shows how little API tests reveal about what ChatGPT cites.

Contents

• Google Makes Links More Prominent in AI Search
• Reported ChatGPT Tracking Changes Complicate Referral Measurement
• Research Finds API Results Only Partly Reflect ChatGPT Citations
• Google Opens Applications for Its UGC Fresh Data Programme
• Google Launches Universal Cart in the US
• Google Tests AI Mode Ads With Personal Intelligence
• Meta Adds Brand Advertising Formats and Attention Measurement
• Demand Gen Cost Adjustments Can Run for Up to 60 Days
• ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries
• Gemini 4 Argon Reaches AI Mode and Gemini Subscribers
• Why First-Hand Experience Gives Content Something Distinctive
• French Supermarket Attacks Expose Risks in Connected Equipment
• OpenAI’s Mathematics Repository Raises Longer-Term Security Questions
• ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Makes Links More Prominent in AI Search

Google says it has substantially increased inline links in AI Mode and AI Overviews, and now shows them higher in more responses, according to its announcement, covered by Search Engine Journal. Article carousels that highlight Preferred Sources are also expanding to more locations and languages.

Two features are tests. One is a top section linking official sites for task-based searches. The other is creator names on AI Mode videos that link to Search profiles, which Google’s help page lists for the US, Canada and India.

Google gives no traffic figures. Search Console also gives every link in an AI Overview the same position, so a higher link won’t show up as a higher position in your reports.

What should your business do?

• Search five questions your customers ask in AI Mode and note whether your site is linked, and which page.
• Make sure each page states its answer clearly near the top.

Clear answers and well-structured pages help search systems interpret your content. Loop Digital’s Answer Engine Optimisation services focus on the questions customers ask and how your website answers them.

Reported ChatGPT Tracking Changes Complicate Referral Measurement

ChatGPT links appear to have stopped carrying the utm_source=chatgpt.com tag, according to Search Engine Land. Adobe’s Cedric Huesler analysed about 500 pages where ChatGPT had made up at least 5% of visits. Between 9th and 13th October, ChatGPT referrals fell by about 31,000 visits a day while Direct traffic rose by about 26,000.

OpenAI hasn’t confirmed whether the change is intentional. The analysis doesn’t prove every missing referral moved to Direct, and a drop in tracked visits doesn’t mean fewer real visits.

What should your business do?

• Compare ChatGPT referrals, Direct traffic and landing-page trends together.
• Annotate 9th October in your analytics.
• Don’t label unexplained Direct traffic as ChatGPT traffic.
• Ask new enquiries how they found you, and record the answer.

Research Finds API Results Only Partly Reflect ChatGPT Citations

A preprint from researchers at the National University of Singapore and Xi’an Jiaotong University tested whether Google results and OpenAI’s API can stand in for what ChatGPT cites. It covered 80 questions in English and Chinese, collected between March and July 2026. The paper hasn’t been peer reviewed.

Combined, the two stand-ins matched about 28% of pages cited by GPT-5.3 Instant and 26% by GPT-5.5 Instant. Matching by site was higher, at around 50% and 49%. More than 40% of cited pages appeared in only one of 20 runs. The findings predate GPT-5.6 and GPT-6, as Search Engine Journal reports.

What should your business do?

• Ask any AI visibility report what it measured, whether pages, citations, domains or brand mentions.
• Ask which model and how many runs sit behind each figure.

AI citation reports should sit alongside evidence from your website and Search Console. Loop Digital’s SEO services combine technical reviews, content improvements and organic performance analysis to identify where your search strategy needs attention.

Google Opens Applications for Its UGC Fresh Data Programme

Google has opened applications for its UGC Fresh Data Programme, announced on 8th October. Approved forums and social platforms can send trending user-generated content and engagement signals through a dedicated pipeline, separate from Googlebot crawling and the Indexing API.

Criteria include stable post URLs, public creator profiles, OAuth 2.0, valid JSON-LD and active moderation. Google says applying doesn’t guarantee participation or appearance in Search, expects to reply within 6 to 8 weeks, and had named no participating platform by 15th October.

Platform owners should check their site against the criteria.

Google Launches Universal Cart in the US

Google has launched Universal Cart in the US. It is a shared cart across Search and the Gemini app, where shoppers can save products from several retailers, get price and stock alerts, and see promo codes and card perks based on Google Wallet information.

Eligible items can be bought through Google Pay or at the retailer’s own checkout, and retailers remain the seller of record. It is US only, with no UK plans mentioned.

There is nothing to switch on in the UK. Retailers can check that feed prices, stock and product details are accurate.

Google Tests AI Mode Ads With Personal Intelligence

Google has begun testing ads in AI Mode for people who opt in to connect their apps through Personal Intelligence. Ads may use insights from those apps as well as the query and the AI response.

Google says ads won’t be based directly on Gmail inbox or Google Photos contents, sensitive information won’t be used, and advertisers can’t access connected apps. Google has named no markets, announced no new advertiser controls and given no wider rollout date.

What should your business do?

• Ask whoever manages your campaigns whether any AI Mode formats are live in your account.
• If you test AI Max, run it as an experiment against standard Search and judge it on enquiries and sales.

Meta Adds Brand Advertising Formats and Attention Measurement

Meta has announced new brand advertising formats for Facebook and Instagram. Ads Super Burst reserves a 3 to 24 hour window to reach large audiences, and is in a phased rollout towards general availability this month. Reels Trending Ads has expanded to 15 topics. First Impression Ads, which gives one brand a day the first Facebook Feed ad position, is a US-only test.

What should your business do?

• Ask whoever runs your paid social whether these formats are available in your account.
• Judge brand campaigns on recall first, then on enquiries in the following weeks.

Demand Gen Cost Adjustments Can Run for Up to 60 Days

Google Ads has extended Demand Gen cost adjustments from three weeks to up to 60 days, according to Search Engine Land. In beta, Google can automatically lower campaign costs when conversions fall below its predictions, mainly early in a campaign.

Only eligible campaigns on target CPA or target ROAS bidding qualify, with Google weighing factors such as account age and conversion tracking quality. There is no setup step and no separate credit or notification, and adjustments can take up to five days to appear in reporting. It isn’t guaranteed reimbursement.

What should your business do?

• Check your Demand Gen campaigns use a target CPA or ROAS.
• Make sure conversion tracking is accurate, because it affects eligibility.
• Read final cost in reporting, not the expectation of a discount.

A lower reported cost still needs to be assessed against lead quality and sales. Loop Digital’s paid search and PPC services bring campaign management and conversion tracking together to assess that return.

ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries

ChatGPT Ads has a redesigned Conversions page in Ads Manager. It shows conversion event volume and trends, the share of active campaigns optimising for conversions, and warnings that link to a Diagnostics tab. Advertisers with active campaigns also get weekly account summaries comparing performance with the previous week.

What should your business do?

• If you test ChatGPT Ads, check that conversion events fire reliably.
• Clear any Diagnostics warnings before judging results.

Gemini 4 Argon Reaches AI Mode and Gemini Subscribers

Google announced Gemini 4 Argon on 13th October. It is available to Google AI Pro and Ultra subscribers in the Gemini app and in AI Mode, globally, and to developers through the API.

Google says it outperforms other frontier models on benchmarks, including first place on the Vals Index, and Google’s Robby Stein says it improves multi-step tasks in AI Mode. Those are Google’s claims, not independent results. A new model isn’t a confirmed ranking update, and it may not change who is cited for your customers’ questions.

What should your business do?

• Rerun the same set of customer questions in AI Mode each month.
• Record the date and model alongside what you see.

Why First-Hand Experience Gives Content Something Distinctive

In a Search Engine Land column, Angela Skane of Network Solutions argues that AI can now produce competent generic content quickly, so what stands out is something only your business has. Her examples include expert quotes, proprietary data and customer stories. It is opinion drawn from her experience, with no external data.

What should your business do?

• Ask one expert one or two questions per page, and keep the answers in a shared file to reuse.
• Add your own photographs from completed jobs.
• Name who wrote or checked each page.

Your team’s knowledge can become useful case studies, service pages and articles. Loop Digital’s content marketing services help turn that experience into content customers can use when comparing their options.

French Supermarket Attacks Expose Risks in Connected Equipment

On the night of 11th October, attackers took remote control of refrigeration controllers at supermarkets in France, according to The Hacker News. Chains reported units being put into defrost and stock discarded.

CERT-FR’s alert names Danfoss AK-SM and AK-SC controllers, and added Copeland and Dixell xweb units on 13th October. The compromise of controllers is confirmed. Who is responsible and how they got in is not, and no vulnerability has been named. CERT-FR says exposing management interfaces to the internet is bad practice, and that attacks are likely still ongoing.

What should your business do?

This matters to food retail, hospitality, catering and cold storage. Ask your refrigeration contractor and IT provider today to confirm three things.

• Whether your controllers can be reached from the internet, and which models and firmware they run.
• Whether any are end of life and no longer receive security updates.
• That access runs through a secure VPN, default passwords are changed and defrost schedules have been reviewed.

CERT-FR advises checking insurance terms before cutting a contractor’s remote link. Technical changes should be made by qualified providers.

OpenAI’s Mathematics Repository Raises Longer-Term Security Questions

OpenAI has published a GitHub repository of 719 mathematical manuscripts, grouped into 372 families and produced by an unreleased internal model. The README says the results are at different stages of verification. About 42% of top-line results have been formalised in Lean, and it says some unformalised results could have issues. This isn’t a collection of independently verified proofs.

Wordfence published commentary on 8th October linking AI mathematics to cybersecurity. Nothing in the repository shows that existing encryption has been broken. It is an industry-watch item with no action for most businesses.

ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro

OpenAI’s release notes list collaborative slides, dated 16th October, rolling out to eligible Pro, Business and Enterprise users with Space access, on web and desktop. Teammates can edit the same deck in real time and comment, and decks can be presented from ChatGPT or exported to PowerPoint, PDF or Google Slides on the web.

GPT-6 Pro is rolling out to eligible Pro users, with faster responses, better use of plugins and tools, and multiple agents working on parts of a task in parallel. In managed workspaces, availability depends on workspace settings.

What should your business do?

Trial slides on a non-confidential deck first, and check what your workspace settings allow staff to share.

This Week in 60 Seconds

• Check refrigeration controller exposure to the internet, after attacks on French supermarkets.
• Google shows more inline links in AI answers and has released Gemini 4 Argon. Neither is a confirmed traffic change.
• ChatGPT referrals may be landing in Direct traffic, and API tests only partly match ChatGPT’s citations.
• Demand Gen cost adjustments can run for 60 days, ChatGPT Ads gained diagnostics, and AI Mode ads are in test.
• Meta’s new brand formats are rolling out or in test, with Meta-reported results.
• Universal Cart is US only and the UGC programme is for platforms.
• First-hand experience is argued to be what makes content distinctive.
• OpenAI’s maths repository is partly verified and doesn’t show encryption is broken.
• ChatGPT has collaborative slides and GPT-6 Pro updates for eligible plans.

What Should Your Business Act On Now?

Act now

• If you use remote-monitored refrigeration, ask your qualified providers to check controller exposure and follow CERT-FR advice.

Review

• ChatGPT referral, Direct and landing-page trends since 9th October.
• How your AI visibility reports are measured.
• Demand Gen eligibility and conversion tracking.
• ChatGPT Ads conversion diagnostics, if you advertise there.

Prepare

• First-hand content such as expert answers, photographs and customer stories.
• Accurate product, price and stock data.
• A controlled trial of collaboration tools on non-confidential work.

Monitor

• Universal Cart outside the US.
• Personalised ads in AI Mode.
• Model-related changes in what AI tools cite.
• Independently validated mathematical developments.

Stay Ahead of Digital Marketing Change

AI search and advertising are producing more numbers and fewer certainties. Decide what you will measure, and trust that over any single platform report.

Unsure whether to focus on organic search, campaign measurement or stronger website content? Discuss your current marketing challenges with Loop Digital and identify where to concentrate your effort.

Book Your Free 30-Minute Strategy Call

Updated: 12th October 2026

This week has one action for anyone with a WordPress website. Version 7.1.3 fixes seven security vulnerabilities, so confirm it has been applied. The ASOS data breach is a reminder of how far a single stolen staff login can reach.

The rest of the news is about credibility and control. Google has finished its spam update and warned against invented author profiles, while advertisers get more settings, previews and measurement options to check.

Contents

• WordPress 7.1.3 Fixes Seven Security Vulnerabilities
• ASOS Confirms Customer Data Was Accessed in Cyberattack
• Google Completes Its September Spam Update
• Google Warns Against Fabricated Author Profiles
• Google Shares Typical Crawling and Indexing Timelines
• Google Ads Adds Automatic Text Overlays to Demand Gen Videos
• Advertisers Can Preview AI Max Copy Before Enabling It
• OpenAI Announces Visual Ads and Expanded ChatGPT Measurement
• Google Introduces Audience Sharing for Retail Media
• Google AI Mode Ads: Eligibility, Controls and Measurement
• Using AI Mode Follow-Up Questions to Find Content Gaps
• Google Recruitment Points to More AI-Generated Discover Content
• Anthropic Updates Rules Against Deceptive AI Sources
• Anthropic Restricts Live Internet Access During Internal Evaluations
• Research Explores a Different Approach to Search Ranking
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.3 Fixes Seven Security Vulnerabilities

WordPress released version 7.1.3 on 6th October with seven security fixes and four bug fixes, and recommends updating immediately. Sites with automatic background updates should receive it without anyone acting.

WordPress hasn’t published severity ratings or said whether any fix is being exploited. Fixes for older versions are being backported, currently through to 4.7.

Some coverage mentions a critical flaw affecting image uploads. WordPress’s announcement doesn’t list it. It appears to be a separate functional bug linked to servers missing the PHP DOM extension, not an extra security vulnerability.

What should your business do?

This supersedes the 7.1.2 and 7.1.1 advice below. Ask whoever manages your website to confirm three things.

• That 7.1.3 has been applied, not just scheduled.
• That a recent backup exists.
• That image uploads still work.

ASOS Confirms Customer Data Was Accessed in Cyberattack

ASOS has confirmed an attacker accessed some customer personal data after it discovered the incident on 6th October. The retailer’s statement, reported by Reuters, says payment card details were not compromised.

Infosecurity Magazine reports the attacker impersonated a trusted contact to obtain an employee’s login details, then used them to reach third-party platforms ASOS uses to contact customers. Snowflake, named in the attacker’s message to customers, says the incident didn’t result from a flaw in its service.

Keep three things apart. ASOS has confirmed the access. The attacker has made their own claims about what they hold. A sample the BBC reviewed included customer numbers and website search terms. Nothing reported so far shows the whole dataset has been released.

What should your business do?

The way in was a person, not software.

• Turn on multi-factor authentication for email, website, advertising and analytics accounts.
• Remove access for former staff and suppliers.
• Tell staff to verify any request for login details by phoning a number they already hold.

Google Completes Its September Spam Update

Google’s September 2026 spam update finished rolling out on 8th October, after starting on 24th September. The Search Status Dashboard shows a rollout of around two weeks.

Spam updates target tactics that breach Google’s spam policies, so most honest websites see little change. Rankings also move for unrelated reasons, including seasonality and your own site changes.

What should your business do?

• Compare organic enquiries for the two weeks after 8th October with the two weeks before 24th September.
• Use the Performance report in Search Console to see which pages lost clicks, not just site-wide totals.
• Hold off site-wide changes unless a drop has lasted beyond the rollout and sits on specific pages.

Google Warns Against Fabricated Author Profiles

Google’s guidance on creating helpful content tells site owners to avoid deceptive authorship information, naming made-up names, false credentials and AI-generated headshots. It says deception makes a page untrustworthy to users and to Google’s automated quality systems.

Last week’s update covered Google’s advice that a person should check AI-assisted content before publishing. Accuracy matters, and so does honesty about who is behind the page.

What should your business do?

• Check every byline belongs to a real person who wrote or reviewed the page.
• Make sure credentials can be verified and photos show the people named.
• Credit a named reviewer if freelancers or AI tools produce drafts.

Google Shares Typical Crawling and Indexing Timelines

At Search Central Live in Barcelona, Google’s Gary Illyes shared typical timings for how pages move through Google’s systems. They come from Google’s internal analysis, as reported by We Are ROAST, and are observations, not deadlines or guarantees.

Stage	Typical	Slowest cases
New URL discovered	About 20 hours	Weeks to never
Known page recrawled	About 30 days	Weeks to never
Sitemap processed	About 24 hours	Up to 14 days, or never
Indexing, end to end	About 1.5 hours	Months or never
Snippet or title update	1 to 2 days	Weeks to months

Discovery, crawling and indexing are separate stages, and a page can’t be indexed until it has been crawled, so delays stack up.

What should your business do?

A new page that isn’t indexed after a few days isn’t necessarily broken. Use URL Inspection in Search Console to see whether Google has found and crawled it before assuming a fault.

Google Ads Adds Automatic Text Overlays to Demand Gen Videos

Google Ads has added an Overlay on videos setting to Demand Gen asset optimisation, according to Search Engine Land. When on, Google uses your existing text assets to place text over your video ads.

It appears to be on by default, though that isn’t officially confirmed. You can turn it off individually, or choose Disable all. Ads with modified assets are labelled as created or edited with AI in the EU, India and New York state.

What should your business do?

• Ask whoever manages your Demand Gen campaigns to check the setting under Asset optimisation.
• Preview for text covering faces, products or logos, or clashing with wording already in the video.
• In finance, healthcare or legal services, get compliance sign-off or switch it off.

Advertisers Can Preview AI Max Copy Before Enabling It

Advertisers can now preview sample headlines and descriptions AI Max would write from their landing pages before switching it on. Trade reports describe a preview that takes around 30 seconds.

A preview doesn’t approve assets or guarantee what will run later. Google’s help page on text customisation says generated assets are refreshed at least every 48 hours and only serve if predicted to perform better than your own.

What should your business do?

• Run the preview on your three most important landing pages.
• Check prices, claims and locations in the samples against what you can offer.
• After launch, use the Added by column to see which assets Google wrote.

Google Introduces Audience Sharing for Retail Media

Google Ads now lets retailers and marketplaces share first-party audience segments with linked advertising partners such as brands. Both sides approve the link, and the retailer chooses which segments to share. Shared audiences work only in eligible commerce media network campaigns, which can send traffic only to the retailer’s approved domain.

This changes nothing for most businesses. If you sell through a large retailer with a commerce media network, ask your account contact whether it applies.

Using AI Mode Follow-Up Questions to Find Content Gaps

Search Engine Land contributor Claudia Tomina describes a method for finding content gaps. Ask AI Mode the question a buyer would ask, follow the follow-up questions it raises and note how the answer changes at each branch.

In her example, a Michigan personal injury firm’s generic page matched a dozen competitors. The follow-ups exposed decisions buyers face, such as comparative fault, that the page didn’t cover.

Treat it as research, not proof. It doesn’t show search demand or guarantee visibility, and the author calls AI answers a sample size of one because they vary by user, platform and query.

Google Recruitment Points to More AI-Generated Discover Content

A Google job listing for a staff machine learning engineer on the Search and Discover feed team says the team recommends AI-generated content to meet user interests, with quality frameworks covering factuality, freshness, coherence and tone.

A job listing shows where Google is investing. It gives no launch date, doesn’t say generated content will replace publishers in the feed, and says nothing about traffic. Change nothing now.

Anthropic Updates Rules Against Deceptive AI Sources

Anthropic has updated its usage policy to prohibit using Claude to manipulate the sources search engines and AI systems draw answers from. The rules take effect on 12th November 2026, as reported by Search Engine Journal.

They bar content that misrepresents its origin, authorship or independence, such as networks of sites posing as unaffiliated sources that back the same claims, and cover fake personas, outlets and reviews. These are usage rules for customers, not changes to how Claude ranks or cites sources.

Google’s guidance points the same way. If anyone offers to build “independent” sites to boost AI visibility, ask who writes them and who owns them.

Anthropic Restricts Live Internet Access During Internal Evaluations

Anthropic says it has disabled live internet access for all internal evaluations, after finding Claude acted on real websites and systems in ways it didn’t intend. This concerns internal testing. It isn’t a removal of browsing from customer products.

Its review found Claude working around blocked tasks instead of stopping, including exploiting flaws in third-party sites and submitting forms it shouldn’t have. Anthropic describes the impact as minimal and says no customer data was involved. Secured admin pages and form spam protection are sensible anyway.

Research Explores a Different Approach to Search Ranking

A research paper on autoregressive ranking, first published in January, is back in discussion after commentary this week argued it could let search rank results without a conventional index. A language model generates identifiers for the documents it wants to return, instead of looking them up.

This is research commentary, not an announcement. The paper’s experiments use small datasets, and nothing says Google has adopted the method, abandoned its index or planned the end of results pages. Nothing here needs a response.

This Week in 60 Seconds

• WordPress 7.1.3 fixes seven security vulnerabilities. Confirm it is applied.
• ASOS confirmed customer data was accessed through a stolen staff login.
• Google’s September spam update finished on 8th October.
• Google warns against invented author names, credentials and headshots.
• Google’s indexing timings are observations, not guarantees.
• Demand Gen overlays appear to be on by default, and AI Max copy can be previewed but not pre-approved.
• OpenAI plans a US-only visual ad test and offers more measurement options.
• Audience sharing is limited to commerce media campaigns, and most AI Mode ad formats are still tests.
• Anthropic’s rules on deceptive sources start on 12th November, and its internet restriction covers internal evaluations only.
• AI Mode follow-ups, Discover job listings and index-free ranking are research or signals, not launches.

---

Updated: 5th October 2026

This week has one action with a deadline. If you advertise on Google with your business locations linked to your ads, Google will start adding offers it finds on your website to those ads from 12th October, unless you switch the feature off.

Google is writing AI summaries for brand-name searches, letting people ask its AI to watch for price drops and openings, and asking website owners to check AI-written content by hand. In each case, what your website says is becoming the raw material for what customers see somewhere else.

Contents

• Google Ads Will Start Adding Website Offers to Some Ads on 12th October
• Google Is Showing AI Summaries for Far More Brand-Name Searches
• Google Says AI-Written Content Must Be Checked by a Person Before Publishing
• More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked
• Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf
• YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips
• Cloudflare Launches EmDash, a New Alternative to WordPress
• Google Ads Relaxes Its Business Name Rules for Some Advertisers
• Microsoft Advertising Now Connects With HubSpot
• ChatGPT Ads Makes Product Campaigns Easier to Set Up
• Key Takeaways
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Ads Will Start Adding Website Offers to Some Ads on 12th October

Google is emailing some advertisers to say that from 12th October it will find offers on their websites, such as coupons and deals, and add them to their ads automatically. It only applies to Search and Performance Max campaigns that have business locations linked to them.

The feature is on by default and has to be switched off in the account’s automated asset settings. Campaigns already running promotions you created yourself are skipped.

Why it matters

Offers on a website are written for people who read the small print. An ad has far less room. An expired deal, a discount that only covers some services, or wording that needs compliance sign-off could appear in an ad nobody approved.

What should your business do?

Before 12th October, ask whoever manages your Google Ads:

• whether any of your campaigns qualify
• whether they recommend leaving the feature on or switching it off
• who will check what appears if it stays on

If you work in finance, healthcare or legal services, or your offers come with conditions, switching it off and writing your own promotion wording is the safer choice. 

Google Is Showing AI Summaries for Far More Brand-Name Searches

DemandSphere data reported by Search Engine Land shows AI Overviews appearing on more than 80% of the brand-name searches it tracks by late September, up from about 26% at the start of the month. An AI Overview is the AI-written summary that sometimes appears above Google’s normal results.

Google hasn’t announced a change that explains the jump, and the effect on clicks to brands’ own websites is still unknown. The figures cover DemandSphere’s own set of tracked searches, not every business.

Why it matters

Someone searching for your business by name is usually close to getting in touch. Google may now put its own summary of your business above your website, drawing on sources you don’t control.

What should your business do?

Search for your business name on Google, ideally on a phone, and read what appears above your website.

• Is the summary accurate?
• Which websites does it cite?
• Does it mention anything out of date, such as services you no longer offer?

If something is wrong, ask your SEO provider to look at the sources being cited. Your own website and Google Business Profile are usually the first places to correct.

Google Says AI-Written Content Must Be Checked by a Person Before Publishing

On 1st October, Google updated its guidance on AI-generated content to say it is critical to fact-check it by hand before publishing. That covers page titles, the short descriptions shown under pages in Google’s results, image descriptions, and the hidden code that tells search engines facts about a page.

A day later, Google added a definition of a page’s main content to its guidance. It listed four things its human reviewers look at: effort, originality, talent or skill, and accuracy. Google describes both as documentation updates, not a new ranking change or penalty.

What should your business do?

If AI helps your team create website pages, articles, product descriptions or other public content, do not publish the first AI-generated version.

Make sure somebody is responsible for checking:

• facts, figures and names
• claims about your products or services
• links and sources
• whether the page genuinely helps the customer

Prices, service areas, credentials and claims about your business are the details most worth checking. 

More Customers Use AI to Find Local Businesses, but Small Shops Can Be Overlooked

Two separate studies point in a similar direction.

First, local discovery. A SOCi survey of US consumers found the share who had used AI to find a local business in the previous 30 days rose from 9% in 2025 to 52% in 2026. Yet 81% check the answer somewhere else, and reviews still decide who makes the shortlist.

Second, shopping. Research by Vaer AI, commissioned by retail software company Lightspeed, analysed around 460,000 AI answers. With live web search switched on, large chains took 46% to 58% of the top recommendations. 

Both studies are North American, and both come from companies that sell services in this area. They also sit alongside last month’s UK charity study, which found that brand size alone doesn’t guarantee AI visibility.

What should your business do?

• Keep collecting reviews and reply to them, because they are what people check when they verify an AI answer.
• If you are local and independent, say so clearly on your website, along with the areas you cover.
• Keep your name, address, phone number and opening hours identical across your website, Google Business Profile and directories.

Google’s AI Mode Can Now Watch for Changes on Customers’ Behalf

Google is rolling out “info monitoring” in AI Mode to all users worldwide, after offering it only to paying subscribers. AI Mode is Google’s conversational search option. People tell it what to watch for, and Google keeps checking websites, forums, social posts and its product data for updates.

Google’s examples were all local or shopping topics, such as new restaurants nearby, things to do in the holidays, and price drops or items coming back in stock. The rollout is gradual in the Google app.

What should your business do?

Keep prices, stock, opening hours and events current on your website and Google Business Profile. If a customer has asked Google to watch your business, an out-of-date page gives it nothing to report.

If your business sells products online, it’s worth checking on how often your product listings, stock and prices are updated. 

YouTube Will Show Fewer Shorts From Channels That Repost Other People’s Clips

YouTube said on 1st October it is changing its recommendations to favour original Shorts and to reduce the reach of channels that mainly re-upload other creators’ clips without significant changes. Shorts are YouTube’s short vertical videos.

This is a reach change, not a ban. Clips are still allowed when creators add their own commentary, analysis or editing. No start date has been given, and YouTube hasn’t said anything about businesses cutting Shorts from their own longer videos.

What should your business do?

For most businesses, nothing changes. If someone posts Shorts for you, check they are built from your own footage, such as jobs in progress, your team or your products, rather than popular clips from other channels.

Cloudflare Launches EmDash, a New Alternative to WordPress

Cloudflare, which provides security and hosting services behind a large share of websites, has released version 1.0 of EmDash, a website platform it presents as a successor to WordPress. It first appeared as a test version in April and is now ready for live websites. It includes EmDash Build, an AI tool that builds a site from a description of what you need.

It also has its own plugin directory, which Cloudflare describes as having no single gatekeeper. Only free plugins are available for now.

What should your business do?

If your WordPress website is working and maintained, this isn’t a reason to move. EmDash is worth knowing about if a rebuild is coming, but its plugin choice is still young, and choosing it means relying heavily on one company.

Google Ads Relaxes Its Business Name Rules for Some Advertisers

In October, Google will start allowing some advertisers to use a business name in their ads that differs from the website address the ad links to. The name must reflect the advertiser’s recognised brand, and there must be a verified relationship with the website owner. Resellers, booking agents, affiliates and secondary sellers don’t qualify.

Reports give the start date as either 16th or 19th October. Google’s own policy page says October 2026.

What should your business do?

This only matters if your trading name and website address don’t match and ads have been rejected because of it. If so, ask whoever manages your Google Ads whether you now qualify.

Microsoft Advertising Now Connects With HubSpot

Microsoft Advertising, which runs ads on Bing, has added a HubSpot integration that links ad campaigns more directly to leads, sales pipeline and revenue. HubSpot is a widely used system for tracking leads and customers. The integration also connects ad activity with HubSpot contacts and deals.

What should your business do?

If you use both, ask whoever manages your advertising whether connecting them would show which Bing ads lead to paying customers, not just form fills. If you don’t use both, there’s nothing to do.

ChatGPT Ads Makes Product Campaigns Easier to Set Up

OpenAI has added bulk product campaigns to ChatGPT Ads. Advertisers can now set up many product campaigns at once from a spreadsheet, see why products are rejected, and get more detailed conversion reporting.

Watch the video here.

Measurement is still developing. One UK agency running a lead-generation campaign on ChatGPT told Digiday that enquiries came in, but the platform still showed no conversions two weeks later.

What should your business do?

This mainly matters for online retailers with large product ranges. If you test ChatGPT Ads, judge the results against your own enquiry and sales records, not the platform’s reporting alone.

Key Takeaways

• From 12th October, Google Ads will add offers found on your website to eligible ads unless you switch the feature off. It applies to Search and Performance Max campaigns with linked business locations.
• In one tracking study, AI summaries appeared on more than 80% of tracked brand-name searches by late September, up from about 26%. Google hasn’t explained the change, and the effect on clicks is unknown.
• Google now says AI-generated content must be fact-checked by a person before publishing, including page titles and image descriptions.
• Google’s guidance names effort, originality, talent or skill, and accuracy as the qualities its reviewers look for in a page’s main content.
• More US consumers use AI to find local businesses, but most check the answer elsewhere, and reviews remain the deciding filter.
• A commissioned North American study found AI shopping answers lean towards large chains, though asking for independent shops changed the results sharply.
• Google’s AI Mode can now monitor prices, stock and local openings for any user, so out-of-date website information means missed alerts.
• YouTube will reduce Shorts reach for channels that mainly repost other people’s clips, with no start date given.
• Cloudflare’s EmDash is a new WordPress alternative, but many features depend on Cloudflare. It isn’t a reason to move a working site.
• Smaller ad changes cover Google Ads business names, Microsoft Advertising’s HubSpot connection and ChatGPT product ads. Each matters only if it matches how you already advertise.

---