If you followed his months of mad ravings, he made it clear that Wordpress is not a true open source project. He has direct control over the project via Automattic appointments in the community, everything is designed to route through his circuitous network of shell corporations and trademarks (wordpress.org is fully under his control and he personally owns the Wordpress trademark - which the "project" licenses from him).
The only reason Wordpress is open source in the first place is because it's a just a fork of b2/cafelog and the original GNU license means derivative works have to be open source as well. (Lost in his moral crusade against WP Engine is the fact that he never really contributed to b2 besides just taking their code).
When the rights were transferred to the WPF, Matt didn't disclose that the Foundation was essentially just him, and the two other nominal members were effectively absent.
When the rights were transferred, and a big deal was made of this, "It now belongs to the WPF, which ensures that no commercial entity or interest can affect what should be a community project", there was no mention of how, on that same day the WPF silently granted a "irrevocable, non-expiring, exclusive universal commercial licence" to Automattic.
Throughout all of this Matt has conflated Automattic, himself, WP.com, WP.org, the WPF to whatever is most convenient to himself.
Matt says himself "I am WordPress.org. It's not a part of the Foundation", but you'd be forgiven for thinking so, given that the website resides on the Foundations AS network...
Matt doesn't want WPE's "revenue-sharing" license agreement to go to the community, the project, or the Foundation, though, he wants it to go to himself, via his private, for profit competitor.
Matt's claim, "My mom is confused and thinks that WPEngine is part of the open source project", is a deflection, and laughable coming from the man who runs wordpress.org as a "independent website" (that just happens to be running on the Foundation's IP addresses) and wordpress.com as a for-profit business. That seems just a little more confusing.
Doubtful. Code isn't what keeps OSS projects going: people do.
Claude can reproduce Wordpress with enough tokens. Claude cannot reproduce the community of maintainers, plug-in authors, users reporting bugs, etc. that is what any real user of Wordpress actually wants (if they don't want buggy, out of date software with security risks).
I think a large % of Wordpress usage is for simple websites that are better served by tools simpler than Wordpress. I'm not sure if you've tried to use Wordpress for a simple site. I did recently and it was a horrendous experience.
Ironically, the antiquated model of a bunch of source code and a database sitting on a computer is something coding agents really like.
WordPress and a nice page builder with MCP is actually a joy to use, and the absolutely enormous catalog of plugins that are easily extensible and endlessly modifiable makes it so easy to work with when building via agent.
Having worked with WordPress for over a decade, I find it hilarious that WooCommerce (the bane of my existence that has inexplicably paid my rent for a gigantic chunk of my adult life) is easier to use and better positioned for building with AI than Shopify.
The future is actually pretty bright for WordPress I think.
The absolutely enormous catalogue is an absolute security (and often maintenance) disaster in 2026.
Those who have ever delivered actual WP sites know the pain of it. Typical WP setups grow very fast growing towards completely entangled mess of plugins and template hacks as the project matures.
I have worked professionally in the WordPress space for over a decade, running teams that make plugins used on probably close to a million sites, I’m a (former?) regional WordCamp organizer, and I’ve built and deployed sites on WordPress for clients, our products, and personal projects ranging in complexity from single page brochure sites to ecommerce/hybrid SaaS monstrosities.
The security issues with WordPress aren’t fake, but they are not nearly as bad as the reputation is. The main reason WordPress gets a bad rap is companies like Patchstack have a financial incentive to abuse CVEs and scare people into buying their products.
For example, we have had numerous CVEs from them stating that they found an RCE in our plugins (!). Oh no! CVE filed. Reproduction steps:
1. Log in as a site admin with full access to the database and file system of the site.
2. Scroll past an input field in our plugin where you can type in arbitrary PHP and have it executed.
3. Do some magical incantation to fire some useless hook.
——
Hello Toyota, I found a security problem- the center console inside the car can be opened by unauthorized users. As some vehicle owners may place valuables there, it exposes them to the possibility of theft.
Steps to reproduce:
1. Unlock the car door and enter the vehicle using your key.
2. Open the center console.
Proposed security fix: Require the vehicle’s key, an RSA fob, and iris scan to open the center console. You have 15 days to recall all vehicles in your fleet that have an unsecured center console. Here are several blog posts that will be going live after the deadline:
• All Toyota Cars Insecure And Anything You Put Inside Can Be Stolen By Anyone Unless You Give Us $50/mo
• Toyota Car Alternatives Because of Vulnerability
• How To Secure Toyota Cars
• Safe Toyota Cars Near Me
• Toyota Car Discount Code Security
——
Their whole business model is to file CVEs, get to them to rank on Google, and then blast out press releases scaring people into paying for their garbage plugin.
There have been real issues, like the Bricks thing, where actual sites did get hacked. But this is a fact of life, if you expose your server/data to the internet at some point it very well may get compromised. I’m sure a few people had a bad day, but if you have a WordPress site and care about security literally all you need to do is put it on a half decent host and they will use a WAF and won’t have to worry about anything.
There are plenty of household names running WordPress at scale like Rolling Stone, Time, the White House, Techcrunch, etc. They aren’t doing much different from what a $5/mo blog on GoDaddy gets in terms of security, and they certainly aren’t running Patchstack (I really hope someone doesn't sniff their sites or tell me they are providing a WAF for them etc and prove me wrong lol).
> I'm not sure if you've tried to use Wordpress for a simple site. I did recently and it was a horrendous experience.
As someone who made a number of bespoke backends, WordPress wins on turnkey host-support, ease of content-authorship, familiarity (when handing over or taking over a backend), and breadth and depth of plugins. A lot of people would be well-served by static-site generators, and those were on the rise for a bit. WordPress stays winning because of the user-friendliness of its publishing workflows (vs SSGs), and self-reinforcing ecosystem.
I hear the words you're saying. But this was not the case for myself setting up Wordpress and trying to help a non-technical user navigate the admin dashboard to manage their content.
You don’t need them 99% of the time as these mods and plugins are effectively what WP lacks. For most trivial sites, and WP does lots of them, they can be promoted.
It is much easier to prompt a relatively tight slop doing the same that WP plus dozens of plugins does. Particularly if you know what you’re doing.
Only because it's forced to be because it in turn was a fork of a previous GPL license.
It should be noted that Mullenweg has regularly weaponized the GPL license in the past - using it to take out other companies in the ecosystem like in their fight against Thesis.
You make the CSS and branding into a thing that folks are "discouraged" from distributing. That's most of the WP plugin and theme ecosystem, or was when I retired from it.
I'm thankfully about 4 years out of making a living un-fucking WP sites but one of the strangest things about the ecosystem is about "for-sale" GPL software.
It's felt somewhat unique to WP for sure, though maybe there are other examples where swaths of communities get big mad when people suggest distributing GPL software for free. I found it a little repellent, but lots of folks scraped together micro-scale businesses selling plugins and themes.
I believe I made a lot better living building stuff for clients and then not caring about what they did with the software, but hey, I'm not the boss of folks trying to make a living supporting a $10 lifetime membership to an image size selecting plugin.
Anyhow, my point is that there is at least a little nuance to be found when thinking about WP and open source software.
Red Hat most memorably has tried it with "technically you are legally permitted to distribute these things we are giving you under contract but we will terminate your contract if you do."
* Donated the WordPress trademark to the nonprofit WordPress Foundation in 2010
* Started bbPress (2004), the first WordCamp (2006), and Five for the Future (2014) which was contributing 3,786 hours/week to WordPress core
* Fought the 2010 Thesis dispute to establish that WordPress themes/plugins must be GPL
* Open-sourced Calypso (2015), Jetpack, and Gutenberg (2018)
* Kept WooCommerce GPL after buying it in 2015
* Founding member and platinum sponsor of the PHP Foundation since 2021, a tier starting at $100,000/year, which funds 12 PHP core developers
* Personally backed Matrix via Patreon from 2017, then Automattic invested $4.6M in Matrix/Element in 2020. Also acquired and open-sourced the ActivityPub plugin (2023)
* Drove the WordPress Foundation's $100,000 donation to the Internet Archive in Oct 2024, on top of $15,000/year each to Black Girls Code and Internet Archive since 2017
* Rescued Openverse (ex-CC Search, 700M+ open-licensed works) when Creative Commons dropped it in 2021
* 1,000+ sponsored WordCamps held in 65+ countries under the community model he set up
Sometimes I don't understand HN's skepticism of the hackers and nerds who have been in the community for decades and have a track record of doing, or trying to do, the right thing. Say what you will about his behavior, or his tone, or the way he approaches his online persona, but it's hard to find any commercial CEO who has towed the line of open source and giving back vs. making a living and employing thousands of people better than him.
If we gave "Open"AI a tenth of the grief we give WP and Matt, the world would be a very different place.
> * Donated the WordPress trademark to the nonprofit WordPress Foundation in 2010
Fallen at the first hurdle. The WordPress Foundation is Matt’s personal vehicle used to obscure his control over the WordPress ecosystem. He has misrepresented the foundations role for over a decade, it was only following the WP Engine debacle that the true status of the foundation and Matt’s personal ownership of WordPress.org came to light.
The spirit of Open Source is contributing to the world for the greater good, not building your personal fiefdom. Matt is rare because he’s one of the few people in Open Source who are so desperate to launder their reputation. Most either acknowledge their project as theirs over which they exert absolute control or they hand over control to the community. Matt pretended to be a benevolent steward for decades until his position was threatened. He has long since cashed in all the credit he earned for his Open Source contributions.
You’ll find dozens of examples of tech CEOs that spend some of their corporate budget on sponsorships of open source projects and events. Matt was relatively unique in 2006, but not in 2026.
- The Wordpress Foundation has one Chairman (Matt) and until last year had one publicly known employee (executive director, Matt)
- Founded several orgs... that contribute solely to WordPress Core. Which is basically his.
- Made Thesis give up their rights to their own non-derivative work. (If we say literally any CSS or PHP on top of Wordpress is derivative work, that's the same as saying no one is allowed to sell any WP services on their own).
- Jetpack, Calypso, and Gutenberg might be open source, but all depend on closed source infrastructure provided by Automattic (Gutenberg is also one of the worst things to happen to WP)
- Kept WooCommerce after consolidating it into his empire - woo hoo?
- He conveniently became the lowest tier contributor to PHP... right before he started his war
Literally outside of small token contributions, all he has done is contributed to projects that support his own bottom line.
It's not just about giving back. As someone who has made a living from web development, his arbitrary attack on vendors within the ecosystem was a massive rugpull. His whole justification is that people shouldn't profit from the ecosystem without contributing. Well that describes literally everyone using Wordpress for free. I have no reason to trust or use WP ever again - and I might as well go to a paid ecosystem where I'm not treated like a pawn.
Has very little to do with the current brou-ha-ha, but I just realised its “Automattic” because his name is “Matt”. It’s like a veil over the world has been lifted.
That’s fast! It usually takes me decades, if ever, to figure out this stuff. One of the downsides being slightly autistic and taking everything too literal
Not sure if it makes me autistic though, I mean, companies use wrong spellings all the time to differentiate, so often that I don't give much thought to it any more.
It has, but I only learned about it when the drama started hitting HN recently. But since I learned about the guy and the company in the same headline I put two and two together right then and there. I've learned some suspicion of founders who name companies after themselves.
Y combinator helped people notice it when they invested in a company called Automatic https://www.ycombinator.com/companies/automatic However now that it's been acquired that reminder of Automattic not being named Automatic is gone.
> One person speculated that the timing may have something to do with Mullenweg’s annual trip to the Burning Man festival, after which he tends to return “with ideas.”
Ironic how hard he tries to seem like a man of a people and then posts about his million-dollar toys he buys from celebrities like John Mayer. Dude is the definition of out of touch.
Changing jobs can be rough or maybe even impossible in this job market. I'm sure there are many there that are not aligned with Matt, but just need the steady paycheck. Same was true after Elon took over twitter.
Applying the word "impossible" to leaving a white collar job seems like a stretch. Also the buyout was almost 2 years ago now, anyone still there must be either in dire financial straits or quite commited.
That's until you find yourself in this job market and you realize now how stupid the digital creation job market and overall jobs are. Once you get laid (off) you are now you're in a pile of 100(edit 1000s) other applicants equally qualified vying for the same job and then hundreds of thousands who can all type to Ai to do a job that once required knowledge & skill.
The software job market, especially for those of us outside the major tech hubs has been severely biased in favor of employers for the last 3 years, with constant layoffs and rising inflation.
If I was working for Automattic I can definitely see electing to stay there until the job market improves.
> Also, if you're just there for a paycheck, you're probably not that upset at distractions.
Not true, I've worked jobs where I was there for the paycheck, I'd still prefer that it be a stable working and environment and still wanted to do good work.
I'm happier when work doesn't expect me to be "part of the vision" or "part of the family", treat me with respect, I'll treat you with respect and do good work - that's all it needs to be.
Or they need the pay. It's all well and good to go "they could just leave" but then what? Spend 6 months looking for a new job only for everyone to go "sorry, the hundreds of thousands of layoffs from every other highly skilled tech workforce beat you to it"?
Just when we (the WP community) thought things were settling down and cooler heads might be prevailing... this happens. Uhg, not great for someone who has invested over 15 years into building with WP and does (paid) business with an Automattic company.
This drama started in April 2025 and there were replies to my comments here on HN telling me WordPress is "dead" and that the community would soon jump ship. Neither happened (not even remotely), and instead of switching to a different CMS we're just using (on new projects) WordPress as a pure CMS with custom/detached front ends because WordPress is still the best/most mature CMS. 99% of my clients that had WordPress, still have WordPress because small businesses move slow, and most of the "AI WordPress killers" are just glorified chatbots which well, if you've ever tried to manage a large site with a nondeterministic "AI chatbot"... it's obvious why.
Some old twitter users still have animated gif avatars that stop being supported years ago. Maybe their approach is to just stop supporting it for new avatars and grandfathering whoever manage to upload one before.
There’s an old saying in Tennessee (I know it’s in Texas, probably in Tennessee) that says “never strike a king unless you are sure you shall defeat him”. Bust in, guns in hand, and now find they’ve turned to sausages. (A tale as old as time.)
Depends on the rules of the company. Just because he can elect the board doesn't mean he gets to direct their every decision. They are supposed to have their own independent judgement.
Depending on the company rules it is possible they might not be easily replaced during their term in which case they could do a coup in the short term.
What is it about Automattic's structure that lets Matt stay in control? Even Travis got ousted at Uber, and he was the primary founder. Is the company set up in a way that makes removing Matt very difficult?
Don’t underestimate Matt’s disregard for corporate theatre. A board voting to remove a CEO isn’t like firing an employee, there’s an assumption that obviously the founder would not use their elevated access to retaliate. As noted, Matt controls the majority of the voting stock, but he also controls WordPress as a whole. Removing the founder who controls everything against their wishes is basically impossible. Even if removing his access to Automattic’s corporate systems was possible, it takes one “I’ll revoke Automattic’s license to use the WordPress.com domain” to convince the board to blink and Matt is back. Mutually assured destruction. The board probably underestimated just how petty Matt is.
Travis, Altman, they’re egotistical but ultimately respect corporate theatre, they know that circumventing it is a bad idea, that one must participate in the grand performance, as Altman did. Matt doesn’t care, he’ll do as he pleases regardless of the consequences.
If Matt was a rationale shareholder he would know that what he has done here is a death sentence for Automattic but alas he does not care. Matt will watch Automattic burn before he lets anyone usurp him. The irony is that as a supposed open source advocate, he’s harming open source, he’s showing how dangerous it is for investors to invest in the corporate arm of an open source project when the founder has absolute control over the project.
Hopefully the board will call his bluff, except he'll overreact in the most him way, wordpress will die, and we can all get on with our lives because there is no more wordpress.
Why is it that a lot of the rich and powerful people tend to become so childish? Or is it just more visible when rich and powerful people do that? Either way, it’s just cringe throwing tantrums like this.
Davies was supposedly the one who originally cooked up the whole extortion scheme against major players in the WP space. WPE was just the first target of many that were planned. Not that Matt is absolved in any way, but it'll be interesting to see what falls out if and when he throws Davies under the bus.
That'd be the first time I hear about that angle. Mullenweg was pretty public about why he was doing it and it never felt like it was someone else's idea, given his level of commitment. It would be smart to find a scapegoat if you want to stretch your tenure a few years though.
I should probably emphasize "supposedly": I get my facts from the same news rags as everyone, and I at least skim the court filings. Matt has held personal grudges against WPE's leadership for much longer than this most recent affair, so it almost certainly wasn't entirely Davies' idea, might not even have originated with him. But when the CFO discusses at length then signs off on such a novel revenue scheme, that makes him a co-conspirator at least. Barring a settlement, I imagine more details will come out in open court.
You give Matt far too much credit. Matt wouldn’t listen to Davies. Look at what happened to Automattic’s legal counsel, one HN comment that didn’t align with Matt’s world view and he was canned post haste.
Davies perhaps explained to Matt how financially precarious Automattic’s position is but it seems very unlikely for a CFO to advocate for a batshit extortion plot that had no hope of success. Where did you hear that Davies was responsible for the extortion scheme? I haven’t seen that reported anywhere.
VCs typically include clauses to be able to sack CEO and retain board control under specific circumstances. I've seen this happen in a small company I was at, to a CEO that didn't meet rather ambitious financial targets. AFAIK it is all very carefully designed and the power is extremely important to VCs, plus the legalities are well tested (since most losing CEOs will fight it in courtroom).
I really hate this company and how they operate. Key example, they sold a «lifetime» plan for Day One that was quite expensive. I used it a lot and went for it.
After they saturated the market for lifetime buyers, they started launching new features not included for lifetime buyers. Annoying.
Then they started pushing advertising for upgrading. Very annoying.
Then they started taking away features lifetime plan users had already. Infuriating.
Then they made it so that support was only available for users on a subscription plan. My complaints weren’t even answered. Unforgivable.
What relevance will WP have now that AI can build websites?
I see more and more vertical SaaS vendors bundling website migration/building/hosting in their offering. I suspect they may steel away many customers from WP, Wix and competitors.
What do you think?
One challenge is that if everyone uses AI to build their own websites, the security vulnerabilities will be different per site, which is very inconvenient if you want to compromise a huge number of sites simultaneously. It's possible that AI tools for exploiting websites scale to overcome this challenge, but it's going to be hard for AI to compete with Wordpress for security vulnerability density, uniformity, and cost.
Sure but a SaaS vendor already handle security for their own products which are typically dynamic website apps. I agree security is a concern for clients doing it themselves.
Wordpress' security track record isn't great, but I'm worried whether it would be safer if everybody builds their own CMS using AI. Yes, as a general-purpose CMS it has more attack surface, but there are more people working to harden and fix it than for all the little diverse AI-generated sites.
I'd love the diversity of everybody being able to build the sites they want, though. Perhaps we'll see more static HTML/CSS/JS pages.
Update: I love the irony that I just saw the sibling post arguing in the exact opposite direction, that the diversity might make it harder to exploit web sites at scale. Which is also a good point.
I honestly think the founder of a project can do whatever they want and they don't have any obligation to anyone except maybe their co-founders and early major contributors (and in his case as a CEO his employees and investors). If its too annoying for you don't use or contribute to wordpress. Is it a strategic blunder to pressure a competitor using his project if it harms users, I mean it seems like it was? But im not taking sides with a hosting provider competing with the founder under almost any conditions related to their business choices, or forming some kind of personal opinion on the person based on it.
I get that a lot of people are financially dependent on the ecosystem that is Wordpress. But it's a crappy piece of technology that needs overhauling. Is there any modern project designed to replace it with better code/architecture?
At this point someone should just make an API compatible clone so all the plugins, integrations, themes and such work and be done with Wordpress and all that muck around it. Can't be too hard these days with coding agents.
It would have been just a matter of time before he displayed his power with the nonprofit and wordpress.com which he controls personally, independently of the Automattic board. Maybe that is part of why the board gave him his control of Automattic back so quickly.
Directus is great. And free for small organizations and non-profits.
Just saying, there are plenty of good CMSs out there now.
WordPress is junky AF, and the spat with WP Engine over... of all things... how they store backups... it was all so cringe. Felt like it boiled down to WP Engines saying, "We don't need to keep backups on the live server..." And WP saying, "Oh hell yeah you do, you can't have your own way to do rollbacks!" It was literally insane for them to fight about that.
How does he get that intense vibrant pink color on his Twitter profile pic? It looks illuminated. I don’t think I’ve ever seen a color that pops like
that before.
Probably has an HDR layer, kind of surprised social networks let that happen since it's really annoying imo. There was a discussion about it here a couple months ago: https://news.ycombinator.com/item?id=49402521.
> WordPress founder and a key advocate for the open source community
This should probably say self appointed advocate. He really hasn't advocated for much beyond collecting payments to Automattic.
I don't know... WordPress is a pretty huge open source project and community. He also opened Pocket Casts.
He bought Pocket Casts.
Then released under the MPL
Oh, I had no idea. When you said opened I thought you meant founded, my bad!
Nice i didn't realize it was open source now
Was it open source before he bought it? If not, then he indeed opened it.
If you followed his months of mad ravings, he made it clear that Wordpress is not a true open source project. He has direct control over the project via Automattic appointments in the community, everything is designed to route through his circuitous network of shell corporations and trademarks (wordpress.org is fully under his control and he personally owns the Wordpress trademark - which the "project" licenses from him).
The only reason Wordpress is open source in the first place is because it's a just a fork of b2/cafelog and the original GNU license means derivative works have to be open source as well. (Lost in his moral crusade against WP Engine is the fact that he never really contributed to b2 besides just taking their code).
Matt made a big deal of transferring rights.
When the rights were transferred to the WPF, Matt didn't disclose that the Foundation was essentially just him, and the two other nominal members were effectively absent.
When the rights were transferred, and a big deal was made of this, "It now belongs to the WPF, which ensures that no commercial entity or interest can affect what should be a community project", there was no mention of how, on that same day the WPF silently granted a "irrevocable, non-expiring, exclusive universal commercial licence" to Automattic.
Throughout all of this Matt has conflated Automattic, himself, WP.com, WP.org, the WPF to whatever is most convenient to himself.
Matt says himself "I am WordPress.org. It's not a part of the Foundation", but you'd be forgiven for thinking so, given that the website resides on the Foundations AS network...
Matt doesn't want WPE's "revenue-sharing" license agreement to go to the community, the project, or the Foundation, though, he wants it to go to himself, via his private, for profit competitor.
Matt's claim, "My mom is confused and thinks that WPEngine is part of the open source project", is a deflection, and laughable coming from the man who runs wordpress.org as a "independent website" (that just happens to be running on the Foundation's IP addresses) and wordpress.com as a for-profit business. That seems just a little more confusing.
> He really hasn't advocated for much
Like him or hate him, he grew WordPress to be one of the most popular open source projects of all time. It seems fair to call him a key advocate.
WordPress is still GPL licensed.
LLMs will surely fix this ubiquitous position of WP very soon.
Doubtful. Code isn't what keeps OSS projects going: people do.
Claude can reproduce Wordpress with enough tokens. Claude cannot reproduce the community of maintainers, plug-in authors, users reporting bugs, etc. that is what any real user of Wordpress actually wants (if they don't want buggy, out of date software with security risks).
I think a large % of Wordpress usage is for simple websites that are better served by tools simpler than Wordpress. I'm not sure if you've tried to use Wordpress for a simple site. I did recently and it was a horrendous experience.
Ironically, the antiquated model of a bunch of source code and a database sitting on a computer is something coding agents really like.
WordPress and a nice page builder with MCP is actually a joy to use, and the absolutely enormous catalog of plugins that are easily extensible and endlessly modifiable makes it so easy to work with when building via agent.
Having worked with WordPress for over a decade, I find it hilarious that WooCommerce (the bane of my existence that has inexplicably paid my rent for a gigantic chunk of my adult life) is easier to use and better positioned for building with AI than Shopify.
The future is actually pretty bright for WordPress I think.
The absolutely enormous catalogue is an absolute security (and often maintenance) disaster in 2026.
Those who have ever delivered actual WP sites know the pain of it. Typical WP setups grow very fast growing towards completely entangled mess of plugins and template hacks as the project matures.
I have worked professionally in the WordPress space for over a decade, running teams that make plugins used on probably close to a million sites, I’m a (former?) regional WordCamp organizer, and I’ve built and deployed sites on WordPress for clients, our products, and personal projects ranging in complexity from single page brochure sites to ecommerce/hybrid SaaS monstrosities.
The security issues with WordPress aren’t fake, but they are not nearly as bad as the reputation is. The main reason WordPress gets a bad rap is companies like Patchstack have a financial incentive to abuse CVEs and scare people into buying their products.
For example, we have had numerous CVEs from them stating that they found an RCE in our plugins (!). Oh no! CVE filed. Reproduction steps:
1. Log in as a site admin with full access to the database and file system of the site. 2. Scroll past an input field in our plugin where you can type in arbitrary PHP and have it executed. 3. Do some magical incantation to fire some useless hook.
——
Hello Toyota, I found a security problem- the center console inside the car can be opened by unauthorized users. As some vehicle owners may place valuables there, it exposes them to the possibility of theft.
Steps to reproduce:
1. Unlock the car door and enter the vehicle using your key.
2. Open the center console.
Proposed security fix: Require the vehicle’s key, an RSA fob, and iris scan to open the center console. You have 15 days to recall all vehicles in your fleet that have an unsecured center console. Here are several blog posts that will be going live after the deadline:
• All Toyota Cars Insecure And Anything You Put Inside Can Be Stolen By Anyone Unless You Give Us $50/mo
• Toyota Car Alternatives Because of Vulnerability
• How To Secure Toyota Cars
• Safe Toyota Cars Near Me
• Toyota Car Discount Code Security
——
Their whole business model is to file CVEs, get to them to rank on Google, and then blast out press releases scaring people into paying for their garbage plugin.
There have been real issues, like the Bricks thing, where actual sites did get hacked. But this is a fact of life, if you expose your server/data to the internet at some point it very well may get compromised. I’m sure a few people had a bad day, but if you have a WordPress site and care about security literally all you need to do is put it on a half decent host and they will use a WAF and won’t have to worry about anything.
There are plenty of household names running WordPress at scale like Rolling Stone, Time, the White House, Techcrunch, etc. They aren’t doing much different from what a $5/mo blog on GoDaddy gets in terms of security, and they certainly aren’t running Patchstack (I really hope someone doesn't sniff their sites or tell me they are providing a WAF for them etc and prove me wrong lol).
> I'm not sure if you've tried to use Wordpress for a simple site. I did recently and it was a horrendous experience.
As someone who made a number of bespoke backends, WordPress wins on turnkey host-support, ease of content-authorship, familiarity (when handing over or taking over a backend), and breadth and depth of plugins. A lot of people would be well-served by static-site generators, and those were on the rise for a bit. WordPress stays winning because of the user-friendliness of its publishing workflows (vs SSGs), and self-reinforcing ecosystem.
I hear the words you're saying. But this was not the case for myself setting up Wordpress and trying to help a non-technical user navigate the admin dashboard to manage their content.
You don’t need them 99% of the time as these mods and plugins are effectively what WP lacks. For most trivial sites, and WP does lots of them, they can be promoted.
It is much easier to prompt a relatively tight slop doing the same that WP plus dozens of plugins does. Particularly if you know what you’re doing.
> WordPress is still GPL licensed.
Only because it's forced to be because it in turn was a fork of a previous GPL license.
It should be noted that Mullenweg has regularly weaponized the GPL license in the past - using it to take out other companies in the ecosystem like in their fight against Thesis.
How does one weaponize a gpl license in this context?
You make the CSS and branding into a thing that folks are "discouraged" from distributing. That's most of the WP plugin and theme ecosystem, or was when I retired from it.
Prevent anyone else from profiting off of the ecosystem.
Wordpress might technically be GPL, but the code itself routes most of the key features of Wordpress through Automattic.
If you have a massive technical moat around the ecosystem, it would make sense to be against erecting walls.
> Like him or hate him, he grew WordPress to be one of the most popular open source projects of all time. It seems fair to call him a key advocate.
As someone who has contributed to WordPress: WordPress grew on the back of volunteers.
It would be unfair to most non-Automattic "volunteers" if he was attributed all/most credit for what it had become, especially pre-Gutenberg.
I'm thankfully about 4 years out of making a living un-fucking WP sites but one of the strangest things about the ecosystem is about "for-sale" GPL software.
It's felt somewhat unique to WP for sure, though maybe there are other examples where swaths of communities get big mad when people suggest distributing GPL software for free. I found it a little repellent, but lots of folks scraped together micro-scale businesses selling plugins and themes.
I believe I made a lot better living building stuff for clients and then not caring about what they did with the software, but hey, I'm not the boss of folks trying to make a living supporting a $10 lifetime membership to an image size selecting plugin.
Anyhow, my point is that there is at least a little nuance to be found when thinking about WP and open source software.
The WRT54G community tried this for a while.
Red Hat most memorably has tried it with "technically you are legally permitted to distribute these things we are giving you under contract but we will terminate your contract if you do."
This is demonstrably false.
* Donated the WordPress trademark to the nonprofit WordPress Foundation in 2010
* Started bbPress (2004), the first WordCamp (2006), and Five for the Future (2014) which was contributing 3,786 hours/week to WordPress core
* Fought the 2010 Thesis dispute to establish that WordPress themes/plugins must be GPL
* Open-sourced Calypso (2015), Jetpack, and Gutenberg (2018)
* Kept WooCommerce GPL after buying it in 2015
* Founding member and platinum sponsor of the PHP Foundation since 2021, a tier starting at $100,000/year, which funds 12 PHP core developers
* Personally backed Matrix via Patreon from 2017, then Automattic invested $4.6M in Matrix/Element in 2020. Also acquired and open-sourced the ActivityPub plugin (2023)
* Drove the WordPress Foundation's $100,000 donation to the Internet Archive in Oct 2024, on top of $15,000/year each to Black Girls Code and Internet Archive since 2017
* Rescued Openverse (ex-CC Search, 700M+ open-licensed works) when Creative Commons dropped it in 2021
* 1,000+ sponsored WordCamps held in 65+ countries under the community model he set up
Sometimes I don't understand HN's skepticism of the hackers and nerds who have been in the community for decades and have a track record of doing, or trying to do, the right thing. Say what you will about his behavior, or his tone, or the way he approaches his online persona, but it's hard to find any commercial CEO who has towed the line of open source and giving back vs. making a living and employing thousands of people better than him.
If we gave "Open"AI a tenth of the grief we give WP and Matt, the world would be a very different place.
> * Donated the WordPress trademark to the nonprofit WordPress Foundation in 2010
Fallen at the first hurdle. The WordPress Foundation is Matt’s personal vehicle used to obscure his control over the WordPress ecosystem. He has misrepresented the foundations role for over a decade, it was only following the WP Engine debacle that the true status of the foundation and Matt’s personal ownership of WordPress.org came to light.
The spirit of Open Source is contributing to the world for the greater good, not building your personal fiefdom. Matt is rare because he’s one of the few people in Open Source who are so desperate to launder their reputation. Most either acknowledge their project as theirs over which they exert absolute control or they hand over control to the community. Matt pretended to be a benevolent steward for decades until his position was threatened. He has long since cashed in all the credit he earned for his Open Source contributions.
You’ll find dozens of examples of tech CEOs that spend some of their corporate budget on sponsorships of open source projects and events. Matt was relatively unique in 2006, but not in 2026.
- The Wordpress Foundation has one Chairman (Matt) and until last year had one publicly known employee (executive director, Matt)
- Founded several orgs... that contribute solely to WordPress Core. Which is basically his.
- Made Thesis give up their rights to their own non-derivative work. (If we say literally any CSS or PHP on top of Wordpress is derivative work, that's the same as saying no one is allowed to sell any WP services on their own).
- Jetpack, Calypso, and Gutenberg might be open source, but all depend on closed source infrastructure provided by Automattic (Gutenberg is also one of the worst things to happen to WP)
- Kept WooCommerce after consolidating it into his empire - woo hoo?
- He conveniently became the lowest tier contributor to PHP... right before he started his war
Literally outside of small token contributions, all he has done is contributed to projects that support his own bottom line.
It's not just about giving back. As someone who has made a living from web development, his arbitrary attack on vendors within the ecosystem was a massive rugpull. His whole justification is that people shouldn't profit from the ecosystem without contributing. Well that describes literally everyone using Wordpress for free. I have no reason to trust or use WP ever again - and I might as well go to a paid ecosystem where I'm not treated like a pawn.
Edit: Nice try, Matt.
Has very little to do with the current brou-ha-ha, but I just realised its “Automattic” because his name is “Matt”. It’s like a veil over the world has been lifted.
It feels like I see this comment in every single Automattic thread on HN. :)
That’s fast! It usually takes me decades, if ever, to figure out this stuff. One of the downsides being slightly autistic and taking everything too literal
Also noticed it because of this comment chain.
Not sure if it makes me autistic though, I mean, companies use wrong spellings all the time to differentiate, so often that I don't give much thought to it any more.
Hasnt automattic been around for a decade?
Two decades. It was founded in 2005
It has, but I only learned about it when the drama started hitting HN recently. But since I learned about the guy and the company in the same headline I put two and two together right then and there. I've learned some suspicion of founders who name companies after themselves.
Yep, still can't get over how I missed the obvious arrow in the FedEx logo (it's embedded between the "E" and "x") for so many years. Super clever!
Wait until you hear about the Beatles name.
What's with that name?
And ‘Fed’ has a spoon in the middle. (That may not have been deliberate, since even with overnight delivery my takeout still arrives cold.)
Y combinator helped people notice it when they invested in a company called Automatic https://www.ycombinator.com/companies/automatic However now that it's been acquired that reminder of Automattic not being named Automatic is gone.
At least his egotrips make a bit more sense after you realise it.
Someone made the same comment in the thread from a few days back. Yeah, it was the first time I realized it as well.
Relevant: Kumail Nanjiani learns about Automattic https://www.youtube.com/watch?v=BHcrispG_rc
This is great. I'd never seen this clip before!
Astounding.
I've never seen this, but that comment at the end is priceless.
> Mullenweg responded to our inquiry, saying a blog post is forthcoming. When it dropped, it was about him buying a houseboat.
Not a good investment.
It's easily the quote of the month. And we are only halfway into the month.
From yesterday (or two days ago?):
> One person speculated that the timing may have something to do with Mullenweg’s annual trip to the Burning Man festival, after which he tends to return “with ideas.”
True to form, he has already been on Reddit (https://www.reddit.com/user/photomatt) and Hacker News (https://news.ycombinator.com/threads?id=photomatt) to engage in comment wars.
The new Derek Smart.
And this is why screenshots of HN comment threads keep showing up in federal court orders.
(eg, page 24 of https://storage.courtlistener.com/recap/gov.uscourts.cand.43... )
Dude “makes million of dollars” and spends that much time wasting away commenting on Reddit…
Ironic how hard he tries to seem like a man of a people and then posts about his million-dollar toys he buys from celebrities like John Mayer. Dude is the definition of out of touch.
Relevant context - it's not a random houseboat, it's Whole Earth Catalog Stewart Brand's historic houseboat:
https://www.dwell.com/article/mirene-tugboat-stewart-brand-r...
Matt. Give this up. You're literally astroturfing threads about yourself.
This could not be a more clear case of projection - you are being the exact monster you tell people your enemies are being.
Give this up and seek help. You're not the amazingly self-actualized person you think you are.
This must be exhausting for the Automattic staff who just want to get on with their jobs.
Anyone who wanted to get on with their jobs would have taken one of the buyouts. Everyone who still works there has to be committed to Matt.
Changing jobs can be rough or maybe even impossible in this job market. I'm sure there are many there that are not aligned with Matt, but just need the steady paycheck. Same was true after Elon took over twitter.
Applying the word "impossible" to leaving a white collar job seems like a stretch. Also the buyout was almost 2 years ago now, anyone still there must be either in dire financial straits or quite commited.
That's until you find yourself in this job market and you realize now how stupid the digital creation job market and overall jobs are. Once you get laid (off) you are now you're in a pile of 100(edit 1000s) other applicants equally qualified vying for the same job and then hundreds of thousands who can all type to Ai to do a job that once required knowledge & skill.
Only 100? Those are good odds in the current market...
> Once you get laid you are now you're in a pile of 100 other applicants equally qualified
I'm assuming there should be an "off" after "laid"...
I don't know, I've had some years where without "off" would also make sense.
What reality are you living in?
The software job market, especially for those of us outside the major tech hubs has been severely biased in favor of employers for the last 3 years, with constant layoffs and rising inflation.
If I was working for Automattic I can definitely see electing to stay there until the job market improves.
The first buyouts happened before the job market fully tanked.
I'm sure there are people who are stuck and have a house payment, but it was pretty obvious the shenanigans were only going to get worse.
Also, if you're just there for a paycheck, you're probably not that upset at distractions.
> Also, if you're just there for a paycheck, you're probably not that upset at distractions.
Not true, I've worked jobs where I was there for the paycheck, I'd still prefer that it be a stable working and environment and still wanted to do good work.
I'm happier when work doesn't expect me to be "part of the vision" or "part of the family", treat me with respect, I'll treat you with respect and do good work - that's all it needs to be.
I mean, I'm currently working a job where I'm here for the paycheck. I fantasize about a buyout.
My feelings are not "boy I wish I could get back at that grindstone". It's "this is the ride I signed up for"
>Changing jobs can be rough or maybe even impossible in this job market.
Wasn't there a 6 month severance on offer?
In this market, 6 months isn't enough.
or they just love wordpress, the product, so much, and believe in it fully. lol
Or they need the pay. It's all well and good to go "they could just leave" but then what? Spend 6 months looking for a new job only for everyone to go "sorry, the hundreds of thousands of layoffs from every other highly skilled tech workforce beat you to it"?
Just when we (the WP community) thought things were settling down and cooler heads might be prevailing... this happens. Uhg, not great for someone who has invested over 15 years into building with WP and does (paid) business with an Automattic company.
Time for alternatives?
This drama started in April 2025 and there were replies to my comments here on HN telling me WordPress is "dead" and that the community would soon jump ship. Neither happened (not even remotely), and instead of switching to a different CMS we're just using (on new projects) WordPress as a pure CMS with custom/detached front ends because WordPress is still the best/most mature CMS. 99% of my clients that had WordPress, still have WordPress because small businesses move slow, and most of the "AI WordPress killers" are just glorified chatbots which well, if you've ever tried to manage a large site with a nondeterministic "AI chatbot"... it's obvious why.
Makes me wonder if he really is back or the board just "forgot" to take his account offline
Most surprising in this article is the vibrant HDR magenta circle on Matt’s Twitter.
What does that mean? Why is it a surprise?
It’s surprising that Twitter even supports that.
Some old twitter users still have animated gif avatars that stop being supported years ago. Maybe their approach is to just stop supporting it for new avatars and grandfathering whoever manage to upload one before.
I remember seeing that on his avatar since the early days of the WP Engine drama.
It left a temporary spot in my vision after I scrolled it away.
Discussion on the ouster: https://news.ycombinator.com/item?id=49636283
There’s an old saying in Tennessee (I know it’s in Texas, probably in Tennessee) that says “never strike a king unless you are sure you shall defeat him”. Bust in, guns in hand, and now find they’ve turned to sausages. (A tale as old as time.)
I'm just glad to have my last projects off of Wordpress to get to no longer care about drama at Automattic that seems to never end.
Doesn't he control 84% of the voting stock or something? I'm curious how a board could even oust him in the first place. Or so he claims.
The ability to appoint a board member doesn't mean you get to control their every decision. Nor is their fiduciary duty just one shareholder.
Of course usually hand-picked boards don't go against their benefactor, and they're not keeping their seats.
That they did in this case says something about just how bad the situation must be.
It's really strange that a company with such a volatile owner would even have a board. But I guess minority shareholders demand it.
Depends on the rules of the company. Just because he can elect the board doesn't mean he gets to direct their every decision. They are supposed to have their own independent judgement.
Depending on the company rules it is possible they might not be easily replaced during their term in which case they could do a coup in the short term.
When the CEO becomes a diva, the company has lost the plot.
you'd think that but at least one CEO has turned being an annoying diva into being the richest man in the world
What is it about Automattic's structure that lets Matt stay in control? Even Travis got ousted at Uber, and he was the primary founder. Is the company set up in a way that makes removing Matt very difficult?
He controls roughly 84% of the share-stakeholder votes.
Don’t underestimate Matt’s disregard for corporate theatre. A board voting to remove a CEO isn’t like firing an employee, there’s an assumption that obviously the founder would not use their elevated access to retaliate. As noted, Matt controls the majority of the voting stock, but he also controls WordPress as a whole. Removing the founder who controls everything against their wishes is basically impossible. Even if removing his access to Automattic’s corporate systems was possible, it takes one “I’ll revoke Automattic’s license to use the WordPress.com domain” to convince the board to blink and Matt is back. Mutually assured destruction. The board probably underestimated just how petty Matt is.
Travis, Altman, they’re egotistical but ultimately respect corporate theatre, they know that circumventing it is a bad idea, that one must participate in the grand performance, as Altman did. Matt doesn’t care, he’ll do as he pleases regardless of the consequences.
If Matt was a rationale shareholder he would know that what he has done here is a death sentence for Automattic but alas he does not care. Matt will watch Automattic burn before he lets anyone usurp him. The irony is that as a supposed open source advocate, he’s harming open source, he’s showing how dangerous it is for investors to invest in the corporate arm of an open source project when the founder has absolute control over the project.
Hopefully the board will call his bluff, except he'll overreact in the most him way, wordpress will die, and we can all get on with our lives because there is no more wordpress.
Shares. Boards have a lot of power but end of the day the shareholders can remove the board so have the ultimate veto
One sequence here could be the Board fired him (as CEO), then he removed/replaced the Board (as main preferred shareholder).
Either that or he somehow has control over IT and is just shit posting and controlling Slack.
Why is it that a lot of the rich and powerful people tend to become so childish? Or is it just more visible when rich and powerful people do that? Either way, it’s just cringe throwing tantrums like this.
i'm gonna wait to hear it from the people who were saying yesterday they were in control if that's ok
> As of yet, no one at Automattic has heard a confirmation from the board. Mark Davies’ Slack account was also deactivated, sources said.
mhm, ok.
Davies was supposedly the one who originally cooked up the whole extortion scheme against major players in the WP space. WPE was just the first target of many that were planned. Not that Matt is absolved in any way, but it'll be interesting to see what falls out if and when he throws Davies under the bus.
That'd be the first time I hear about that angle. Mullenweg was pretty public about why he was doing it and it never felt like it was someone else's idea, given his level of commitment. It would be smart to find a scapegoat if you want to stretch your tenure a few years though.
I should probably emphasize "supposedly": I get my facts from the same news rags as everyone, and I at least skim the court filings. Matt has held personal grudges against WPE's leadership for much longer than this most recent affair, so it almost certainly wasn't entirely Davies' idea, might not even have originated with him. But when the CFO discusses at length then signs off on such a novel revenue scheme, that makes him a co-conspirator at least. Barring a settlement, I imagine more details will come out in open court.
You give Matt far too much credit. Matt wouldn’t listen to Davies. Look at what happened to Automattic’s legal counsel, one HN comment that didn’t align with Matt’s world view and he was canned post haste.
Davies perhaps explained to Matt how financially precarious Automattic’s position is but it seems very unlikely for a CFO to advocate for a batshit extortion plot that had no hope of success. Where did you hear that Davies was responsible for the extortion scheme? I haven’t seen that reported anywhere.
> Look at what happened to Automattic’s legal counsel, one HN comment that didn’t align with Matt’s world view and he was canned post haste.
I remember this:
https://news.ycombinator.com/item?id=41789765
According to the legal counsel's LinkedIn, he left two months after.
What an absolute clown show. I don't see how anyone can trust WordPress (the company) going forward.
Did someone make a site to track the timeline of the new WordPress situation, like they did with the WP Engine one?
It's all the same situation. https://mullenweg.wtf/
Ouch. Having a website dedicated to one's meltdown is nobody's idea of fame
Does Matt own >50%? If so, the board is irrelevant. If not, I assume he would've been gone long ago.
You don't know what contracts he has signed.
VCs typically include clauses to be able to sack CEO and retain board control under specific circumstances. I've seen this happen in a small company I was at, to a CEO that didn't meet rather ambitious financial targets. AFAIK it is all very carefully designed and the power is extremely important to VCs, plus the legalities are well tested (since most losing CEOs will fight it in courtroom).
Damn it hasn't even been a week.
I really hate this company and how they operate. Key example, they sold a «lifetime» plan for Day One that was quite expensive. I used it a lot and went for it.
After they saturated the market for lifetime buyers, they started launching new features not included for lifetime buyers. Annoying.
Then they started pushing advertising for upgrading. Very annoying.
Then they started taking away features lifetime plan users had already. Infuriating.
Then they made it so that support was only available for users on a subscription plan. My complaints weren’t even answered. Unforgivable.
Day One was acquired by Automattic in 2021 [1]. The move to a subscription model happened in 2017 [2].
[1]https://dayoneapp.com/blog/the-next-chapter-of-day-one-at-au...
[2] https://medium.com/day-one/day-one-goes-premium-424492fd0a5b
Yes, yet the bulk of my issues outlined in the post were after that.
Either they kept introducing even worse policies, or they allowed them
What relevance will WP have now that AI can build websites? I see more and more vertical SaaS vendors bundling website migration/building/hosting in their offering. I suspect they may steel away many customers from WP, Wix and competitors. What do you think?
One challenge is that if everyone uses AI to build their own websites, the security vulnerabilities will be different per site, which is very inconvenient if you want to compromise a huge number of sites simultaneously. It's possible that AI tools for exploiting websites scale to overcome this challenge, but it's going to be hard for AI to compete with Wordpress for security vulnerability density, uniformity, and cost.
Sure but a SaaS vendor already handle security for their own products which are typically dynamic website apps. I agree security is a concern for clients doing it themselves.
Wordpress' security track record isn't great, but I'm worried whether it would be safer if everybody builds their own CMS using AI. Yes, as a general-purpose CMS it has more attack surface, but there are more people working to harden and fix it than for all the little diverse AI-generated sites.
I'd love the diversity of everybody being able to build the sites they want, though. Perhaps we'll see more static HTML/CSS/JS pages.
Update: I love the irony that I just saw the sibling post arguing in the exact opposite direction, that the diversity might make it harder to exploit web sites at scale. Which is also a good point.
So a final nail to the Wordpress coffin then ?
What in the Ashes of Creation is going on over there
Also shoutout Sarah Perez, voice of a generation! Epic pfp
Too much drama. Focus on the product and the users.
Is it perhaps time to ackowledge that boards where everyone is buddies can't actually do their jobs, yet they get paid obscene amounts of money?
No different than how the Cabinet of the United States operates.
Is it perhaps time to ackowledge that cabinets where everyone is buddies can't actually do their jobs, yet they get given obscene amounts of power?
I honestly think the founder of a project can do whatever they want and they don't have any obligation to anyone except maybe their co-founders and early major contributors (and in his case as a CEO his employees and investors). If its too annoying for you don't use or contribute to wordpress. Is it a strategic blunder to pressure a competitor using his project if it harms users, I mean it seems like it was? But im not taking sides with a hosting provider competing with the founder under almost any conditions related to their business choices, or forming some kind of personal opinion on the person based on it.
I get that a lot of people are financially dependent on the ecosystem that is Wordpress. But it's a crappy piece of technology that needs overhauling. Is there any modern project designed to replace it with better code/architecture?
At this point someone should just make an API compatible clone so all the plugins, integrations, themes and such work and be done with Wordpress and all that muck around it. Can't be too hard these days with coding agents.
WP is GPL, just fork it.
Everything that I know about Matt Mullenweg has been against my will.
It would have been just a matter of time before he displayed his power with the nonprofit and wordpress.com which he controls personally, independently of the Automattic board. Maybe that is part of why the board gave him his control of Automattic back so quickly.
Directus is great. And free for small organizations and non-profits.
Just saying, there are plenty of good CMSs out there now.
WordPress is junky AF, and the spat with WP Engine over... of all things... how they store backups... it was all so cringe. Felt like it boiled down to WP Engines saying, "We don't need to keep backups on the live server..." And WP saying, "Oh hell yeah you do, you can't have your own way to do rollbacks!" It was literally insane for them to fight about that.
How does he get that intense vibrant pink color on his Twitter profile pic? It looks illuminated. I don’t think I’ve ever seen a color that pops like that before.
Probably has an HDR layer, kind of surprised social networks let that happen since it's really annoying imo. There was a discussion about it here a couple months ago: https://news.ycombinator.com/item?id=49402521.