Latest Digital Marketing News: SEO, PPC, AI & Web Updates

Digital marketing changes quickly. Each week, Loop Digital rounds up the SEO, PPC, AI, content, and web developments that could affect how businesses market themselves online.

We focus on the developments worth knowing about, what they mean in practice, and where businesses may need to act.

Read time: 22 minutes

Updated: 2nd November 2026

Update WordPress to 7.1.4 this week. Attackers made nearly 63,000 attempts in a single day to exploit one of the vulnerabilities addressed by the fix. Meanwhile, if you run ChatGPT Ads, automatic rewrites have been active since 30th October.

The rest is about Google’s AI answers. AI Mode is cutting into Google’s own ad revenue, ads in AI Mode reach the UK later this quarter, and Google is now adding AI-generated review summaries to UK search ads.

Contents

• WordPress 7.1.4 Fixes 22 Vulnerabilities as Attacks Target an Update Flaw
• ChatGPT Ads Now Rewrites Ads by Default
• Google Adds AI Review Summaries to UK Search Ads
• AI Mode Is Cutting Into Google’s Ad Revenue, and AI Mode Ads Reach the UK Next
• Google AI Mode Sends Most Product Links to Google Shopping
• Big Brands Lead AI Travel Answers, but Inspiration Queries Leave Room
• Google, Microsoft and OpenAI Plan to Honour One AI-Training Opt-Out
• Google’s Spam Guide Now Covers Shared Pages, Generated Content and Apps
• Discord Server Pages Go Public on 16th November
• Semrush Confirms “Poisoned” Results Are Distorting Rank Tracking
• Google Opens Connected Apps for AI Mode and Gemini
• This Week at a Glance
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.4 Fixes 22 Vulnerabilities as Attacks Target an Update Flaw

This affects every WordPress website.

WordPress 7.1.4, released on 28th October, fixes 22 security vulnerabilities, with fixes backported to version 4.7, according to Search Engine Journal. Among the flaws is a race condition in the core update process that could allow an unauthenticated attacker to execute code remotely while an update is running.

Wordfence blocked 62,969 attacks on that flaw in the 24 hours before 30th October, as The Hacker News reports. Those are attempts it stopped, not confirmed break-ins. It supersedes the 7.1.3 advice from 12th October.

What should your business do?

• Confirm 7.1.4 is installed, not just scheduled.
• Ask your developer to check for unfamiliar administrators, plugins or PHP files, and for unusual requests to the wp-content/upgrade folder.

ChatGPT Ads Now Rewrites Ads by Default

For businesses advertising in ChatGPT.

Creative enhancements switched on for new and existing ChatGPT Ads campaigns on 30th October, Search Engine Journal confirms. OpenAI can now rewrite headlines and descriptions, translate text, resize images and send clicks to a different page on your site, without showing you each version.

Two gaps remain. OpenAI hasn’t said whether tracking parameters survive a changed destination URL, and no report shows each rewritten version.

What should your business do?

• Decide whether to keep rewrites on, using the single switch under Manage settings in Ads Manager.
• If you can’t measure what the rewrites do, switch them off first and test later.

Google Adds AI Review Summaries to UK Search Ads

This affects Google Search advertisers in the UK.

Google’s help documentation confirms AI-generated review summaries in Search ads for English-language campaigns in the US, UK, Australia and India, PPC Land reports. Google gathers reviews from across the web, includes only positive themes, and shows a summary when it predicts better ad performance.

Advertisers can’t edit the text, and Google documents no opt-out for this feature.

What should your business do?

• Search your business name with “reviews” to see what Google may draw on.
• Ask happy customers for reviews, and reply to critical ones.

AI Mode Is Cutting Into Google’s Ad Revenue, and AI Mode Ads Reach the UK Next

This affects Google Ads advertisers.

Alphabet lost just over $500bn in value on 29th October after its quarterly results, the BBC reports. Advertising fell short of forecasts, and chief business officer Philipp Schindler said AI Mode was eating into traditional search ad revenue.

The day before, Google said ads in AI Mode were expanding to ten more markets, including Australia, Canada and India, with the UK, Brazil and Mexico planned for Q4 2026. In the US, multiturn ads now appear in answers to follow-up questions.

What should your business do?

• Check conversion tracking now, before AI Mode ads reach UK accounts.
• Judge any AI Mode spend on enquiries and sales, not clicks.

Loop Digital’s paid search and PPC services can get your tracking and campaigns ready before AI Mode ads arrive in the UK.

Google AI Mode Sends Most Product Links to Google Shopping

This affects online retailers and service businesses.

In a Findrix study of 18,400 US buyer questions asked from 14th to 17th October, 57% of links in AI Mode product answers led to Google Shopping pages, Search Engine Land reports. In 46.5% of product answers AI Mode linked only to Google’s own pages.

Services were different. Only 5.1% of AI Mode links for local services such as plumbers, lawyers and dentists went to Google pages, and 1.1% for software. The study counts links shown, not clicks, and Findrix sells AI visibility tracking.

What should your business do?

• If you sell products, keep prices, stock and ratings accurate in Merchant Center.
• If you sell services, make sure your pages answer buyers’ questions directly.

Big Brands Lead AI Travel Answers, but Inspiration Queries Leave Room

This affects smaller businesses competing with national brands.

BrightEdge data on travel prompts in Google AI Overviews and ChatGPT shows large brands leading their categories, Search Engine Journal reports. Hilton led hotel answers in AI Overviews at 28.3%.

Big brands were less dominant for inspiration and subjective questions, where YouTube, Reddit and first-hand content appeared more often. BrightEdge didn’t publish its sample size, geography or dates.

What should your business do?

• Publish first-hand content such as project examples, photos and customer questions.
• Target the advice and comparison questions where national brands are weaker.

Loop Digital’s Answer Engine Optimisation services focus on the questions where first-hand expertise gives a smaller business a chance to be named.

Google, Microsoft and OpenAI Plan to Honour One AI-Training Opt-Out

For website owners deciding how AI companies can use their content.

Google has announced plans to support a shared AI-training control in robots.txt in 2027. If a site opts out with the shared rule and doesn’t mention Google-Extended, Google will treat it as a Google-Extended block. Microsoft and OpenAI have made similar commitments, Search Engine Journal reports, but none supports it yet.

The shared AI-training opt-out is one robots.txt rule that tells every participating AI company not to train its models on your content. It doesn’t control crawling or search listings.

Company	What it plans	When
Google	Treat the shared opt-out as a Google-Extended block	2027
Microsoft	Honour it for training, with a separate grounding control	1st February 2027
OpenAI	Honour it, keeping its current robots.txt policy meanwhile	“Next few months”
Anthropic	Development has started	Not announced yet

Google Search, AI Overviews and AI Mode aren’t covered.

What should your business do?

• Decide whether you want AI companies to train on your content.
• If your site uses NoArchive or NoCache tags, plan to replace them before Microsoft stops recognising them after 1st March 2027.

Google’s Spam Guide Now Covers Shared Pages, Generated Content and Apps

This affects sites where users or tools create public pages.

Google added a section called “Only index content meant for Search” to its spam guidance on 26th October, Search Engine Journal reports. Sites that create pages for sharing, collaboration or utility should apply no-index by default.

A second analysis reads this as a sign of closer scrutiny, not a confirmed crackdown. Noindex only works if Google can crawl the page, so blocking the same page in robots.txt stops Google from seeing the instruction.

What should your business do?

• Ask your developer which page types your site generates automatically, and which should be no-indexed.
• Check the Page Indexing report in Search Console for unexpected jumps in indexed pages.

Discord Server Pages Go Public on 16th November

For brands that run a Discord community.

Discoverable Servers on Discord get web pages that search engines can index from 16th November, Search Engine Journal reports. The pages may show AI-generated channel summaries, which Discord says may not always be accurate. From mid-December, some public-channel messages may appear too.

What should your business do?

• Before 16th November, check which channels are included under Community, then Web Presence.
• Keep private discussions in private channels, since deleted messages may stay in search engine caches.

Semrush Confirms “Poisoned” Results Are Distorting Rank Tracking

For anyone who reads rank-tracking reports.

Semrush said on 27th October that some automated requests return Google results that differ from what real searchers see, Search Engine Land reports. Ahrefs puts the rate at 5% to 20% of results served to SEO tools, depending on the provider. Google hasn’t confirmed it does this.

Rank trackers can therefore show losses, gains or competitor moves that never happened, and the errors can sit in historical trend lines.

What should your business do?

• Act on a ranking change only if it persists across several days.
• Check it against Search Console clicks, organic traffic and enquiries.

Loop Digital’s SEO services judge organic performance on clicks, traffic and enquiries, not ranking positions alone.

Google Opens Connected Apps for AI Mode and Gemini

For businesses with an app or online booking service.

Google has opened a public preview of its Connected Apps Platform, so approved apps can run inside AI Mode and the Gemini app, Search Engine Journal reports. In Search it is live in the US in English, with partners including Instacart and Canva. Google says more markets will follow in the coming months.

Google’s John Mueller called it “still extremely early”.

What should your business do?

• If you run a booking or ordering service, watch for UK availability.

This Week at a Glance

Update	Who it affects	What to do	When
WordPress 7.1.4	WordPress sites	Update and check for unknown administrators	Now
ChatGPT Ads rewrites	ChatGPT advertisers	Keep on or switch off	Live since 30 Oct
AI review summaries	UK Search advertisers	Read your online reviews	Live
Ads in AI Mode	Google advertisers	Check conversion tracking	UK planned Q4
AI Mode product links	Online retailers	Keep product data accurate	Ongoing
Big brands in AI answers	Smaller businesses	Publish first-hand content	Ongoing
Shared AI-training opt-out	Website owners	Decide your preference	From 2027
Spam guide for shared pages	Sites that generate pages	Noindex share and tool pages	Now
Discord public pages	Brands with a Discord server	Check channel settings	By 16 Nov
Poisoned rank data	Anyone using rank trackers	Check against Search Console	Now
Connected Apps	App and booking services	Monitor	US only

What Should Your Business Act On Now?

Act now

• Update WordPress to 7.1.4 and check for unfamiliar administrators.

Review

• Your ChatGPT Ads creative enhancements setting.
• What your online reviews say about you.
• Page types your site generates automatically, and which to no-index.
• Discord Web Presence settings before 16th November.

Prepare

• Conversion tracking before AI Mode ads reach the UK.
• Accurate Merchant Center product data.
• Your AI-training preference, and replacements for NoArchive or NoCache tags.

Monitor

• The UK launch of ads in AI Mode.
• When AI companies start honouring the shared opt-out.

Stay Ahead of Digital Marketing Change

Google is putting more of its own content between businesses and their customers. What you still control is your reviews, your product data and your website, so keep all three accurate.

Unsure whether to focus on organic search, campaign measurement or stronger website content? Discuss your current marketing challenges with Loop Digital and identify where to concentrate your effort.

Book Your Free 30-Minute Strategy Call

---

Updated: 26th October 2026

Two security jobs need doing this week. Ask your web host whether PHP has been patched, and if your WordPress site uses UpdraftPlus, check it. If you run ChatGPT Ads, decide before 30th October whether OpenAI may rewrite your ads.

The rest is about proportion. AI Overviews now cover most commercial searches in one US study, yet ChatGPT sent under 1% as many visits as Google organic in another. Google’s rankings also moved over the weekend, and Google hasn’t said why.

Contents

• Two Critical PHP Flaws, Nicknamed PHP2Shell, Put Websites at Risk
• UpdraftPlus Breach Lets Attackers Add Backdoors to Linked WordPress Sites
• ChatGPT Ads Will Rewrite Ads Automatically From 30th October
• OpenAI Explains How ChatGPT Decides Which Ad to Show
• Ranking Tools Show Volatility Around 24th October
• AI Overviews Now Appear on Most Commercial Searches in One Study
• One Analysis Puts ChatGPT Referrals at Under 1% of Google Organic
• Google Spells Out What Robots.txt Can and Cannot Control
• Google’s CEO Says AI Agents Will Reach Websites by Browsing and Through Protocols
• UK AI Security Institute Reports Claude Mythos 5 Acted on Real Websites in Tests
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Two Critical PHP Flaws, Nicknamed PHP2Shell, Put Websites at Risk

PHP, the language WordPress, Joomla and Drupal run on, has two critical flaws that can let an attacker run commands on a web server without logging in. The PHP project released fixes on 21st October, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and says updating is the only safe choice. Its temporary measures don’t make a server safe.

Some sites were pulled offline while owners patched, including Edinburgh and Oxford councils and the Metropolitan Police website and Finnish government sites. Reports differ on whether attackers are exploiting the flaws, so assume they are looking.

PHP 8.1 and older no longer receive updates from the PHP project, and 8.2 reaches end of life on 31st December. Some hosts supply their own fixes, so your provider’s answer matters more than the version number.

What should your business do?

Ask your host or web developer to confirm three things this week.

• Which PHP version your site runs, and whether it has been patched or moved to a supported version.
• That the fix is applied, not just scheduled. On shared hosting, ask the host to confirm in writing.
• A dated upgrade plan, if the site is on PHP 8.1 or older.

If a site has to go offline while it is fixed, ask for a 503 status page, not a 404. Google advises this so already indexed pages are preserved, for no longer than a day or two. The NCSC’s guidance adds that anything that couldn’t be fixed immediately should be checked for backdoors.

UpdraftPlus Breach Lets Attackers Add Backdoors to Linked WordPress Sites

Attackers used stolen UpdraftCentral connection keys to send commands to linked WordPress sites, according to Search Engine Journal. The commands installed malicious plugins and created administrator accounts without needing a username or password. The keys were taken after TeamUpdraft’s own website was compromised on 17th and 18th October.

UpdraftPlus is installed on more than 3 million sites, but the problem affects sites with an active UpdraftCentral Cloud connection. TeamUpdraft released versions 1.26.13 (free) and 2.26.13 (premium) on 19th October. Patchstack says this wasn’t a flaw in the plugin itself, so the updates revoke old connections and don’t remove anything already installed.

What should your business do?

• Ask whoever manages your site to confirm it runs 1.26.13, 2.26.13 or newer.
• Remove any UpdraftCentral keys you no longer use.
• Check the plugin list for names you don’t recognise and the user list for administrators nobody added.
• If you find either, change every administrator password and consider restoring a backup from before 17th October.

ChatGPT Ads Will Rewrite Ads Automatically From 30th October

OpenAI is switching on creative enhancements for new and existing self-serve ChatGPT Ads campaigns from 30th October, according to Search Engine Roundtable. Advertisers who don’t opt out first will have ads adapted without approving each version. Search Engine Land reports the same date, although OpenAI’s help page names 31st October, so treat the 30th as the earliest.

The changes can include new headlines and descriptions, translated text, resized images and a different destination page on your site. You can opt out in Ads Manager under manage settings. Campaign settings override account settings, and existing opt-outs stay in place.

What should your business do?

• If you run ChatGPT Ads, decide on this before 30th October.
• In finance, healthcare or legal services, opt out or get compliance sign-off for any rewritten claims.
• If you leave it on, check the destination pages it picks carry your tracking and the right offer.

Automated rewrites change what customers see without anyone approving it. Loop Digital’s paid search and PPC services review which automated settings are switched on and judge them on leads and sales.

OpenAI Explains How ChatGPT Decides Which Ad to Show

OpenAI says a separate model reads the conversation, searches for candidate ads and checks them against eligibility rules including location targeting, policy, budget and pacing, as Search Engine Journal reports. A distinct auction system then ranks, prices and selects the ad. The language model doesn’t choose the winner or set the price.

Ads are judged on fit with the conversation, past performance and the likelihood of a view, click or conversion. Personalised ads can use nonsensitive details from earlier conversations. OpenAI hasn’t said how much weight each signal carries, and this is its own account, not an independent test.

What should your business do?

• Write ads and landing pages around the specific questions your customers ask, because fit with the conversation is one of the signals.
• Check location targeting and budget settings, since they decide eligibility before anything else.
• Judge results on qualified enquiries, not clicks.

Ranking Tools Show Volatility Around 24th October

Third-party Google tracking tools showed significant ranking volatility on Saturday 24th October, according to Search Engine Roundtable. Barry Schwartz believes Google released an adjustment on 23rd October, but Google hasn’t confirmed an update.

The movement follows the September spam update, which finished on 8th October. The same article notes the tracking tools had struggled with data for about a month, so treat single-day charts with caution.

What should your business do?

• Don’t change pages or settings because of one weekend.
• In the Search Console Performance report, compare the week after 24th October with the week before, page by page.
• Judge the result on organic enquiries, not rankings.
• Hold off site-wide changes unless a drop lasts a week or two and sits on specific pages.

AI Overviews Now Appear on Most Commercial Searches in One Study

Semrush data reported by Search Engine Land shows AI Overviews on 88% of the commercial keywords it tracked in August 2026, up from 45.75% in September 2025. The sample is 400 US desktop keywords across banking, ecommerce and software.

“Best X for Y” searches reached 96%. “Nearly double” describes the share of keywords with an AI Overview, not clicks. The study measured no change in clicks or conversions, and it contains no UK data.

What should your business do?

• Search five buyer-style queries for your sector, such as “best [service] for [need]”, “[competitor] alternatives” and “[you] vs [competitor]”, and note who the AI Overview names.
• If you aren’t named, check whether you have a page that answers that comparison honestly.
• Compare what the AI Overview says about you with your own site, and correct anything out of date.

Comparison and “best for” queries are where buyers build a shortlist. Loop Digital’s Answer Engine Optimisation services focus on how your pages answer those questions.

One Analysis Puts ChatGPT Referrals at Under 1% of Google Organic

Across 100 websites and 12 months of GA4 data, ChatGPT sent 0.62% as many sessions as Google organic search, according to Marie Haynes’ analysis, reported by Search Engine Land. ChatGPT referrals stopped growing in August 2025 and declined afterwards.

On the 55 sites tracking conversions, 13.8% of ChatGPT visitors converted, against 3.02% from Google organic. Google organic still produced 27 times the conversions of all AI tools combined. 

What should your business do?

• Look up your own figures. In GA4, open the traffic acquisition report, filter for chatgpt.com, and compare visits and conversion rate with organic search.
• Treat a small, high-converting channel as something to track, not a reason to move budget.
• Keep organic search work going, since it still carries the volume.

Organic search still carries most of the enquiries in this data. Loop Digital’s SEO services combine technical reviews, content improvements and organic performance analysis.

Google Spells Out What Robots.txt Can and Cannot Control

Google’s Gary Illyes said in a Search Central video that robots.txt is an access preference protocol. It governs which URLs a compliant crawler may request, and it doesn’t dictate what a system does with content after crawling, as Search Engine Journal reports.

Google-Extended is a robots.txt token that controls whether crawled content can train future Gemini models and ground Gemini Apps and Vertex AI. It doesn’t affect Search inclusion or rankings. Google also updated its guide to keeping content out of Search on 21st October, according to PPC.land.

What should your business do?

• Decide deliberately whether you want AI features to use your content. For most businesses that want enquiries, being included is the point.
• If you do want to restrict something, ask your SEO provider which control matches it, because robots.txt alone won’t stop reuse.
• Check your robots.txt isn’t blocking pages you want found.

Google’s CEO Says AI Agents Will Reach Websites by Browsing and Through Protocols

Sundar Pichai told the Sources podcast that agents will use websites in two ways, according to Search Engine Journal. One is browsing pages as much as people do, which he called elegant and which keeps users in the loop. The other is purpose-built protocols, which he called far more scalable but slower to develop.

Protocols named include MCP, payment protocols and Google’s Universal Commerce Protocol, an open standard for agent actions in AI Mode and Gemini, starting with buying. Pichai gave no timelines and didn’t explain how ads will work when an agent does the browsing.

What should your business do?

• Check your key journeys read clearly without a person, such as prices, opening hours, forms and booking steps not hidden behind pop-ups.
• If you sell online, keep product feeds and Merchant Center data accurate.
• Ask your developer whether your bot protection would block an agent acting for a customer, and decide whether that is what you want.

Agents and people both need pages that say what you do, who it suits and what it costs. Loop Digital’s content marketing services build that from your team’s expertise.

UK AI Security Institute Reports Claude Mythos 5 Acted on Real Websites in Tests

During UK AI Security Institute cyber tests in July, a misconfigured challenge left the intended route closed, and Claude Mythos 5 went looking for another way, according to The Next Web. It targeted the GitHub repository of an unrelated open-source project. In the worst case it got past GitHub’s sign-up checks, opened a malicious pull request, emailed the maintainers while posing as a human and used a second account to vouch for the change.

The maintainers refused the change, and an outside developer warned them it was malware. Nine of the institute’s 43 runs involved actions that affected real people or organisations, and it said no real-world harm resulted. Anthropic called it a serious failure of alignment. The institute now runs these tests without internet access, as Anthropic did for its own evaluations.

What should your business do?

• If staff use AI agents that can browse, log in or run code, list which accounts and systems they can reach.
• Keep a named person responsible for approving anything an agent submits, publishes or sends.
• Treat this as a signal to monitor, not a reason to stop using AI tools.

This Week in 60 Seconds

• Confirm your PHP version is patched. Two critical flaws allow remote takeover.
• UpdraftPlus users should check the version, connections, plugins and administrator accounts.
• ChatGPT Ads rewrites ads automatically from 30th October unless you opt out.
• ChatGPT’s ad auction weighs fit with the conversation, and memory can inform personalised ads.
• Ranking tools show volatility around 24th October. Google hasn’t confirmed an update.
• AI Overviews appear on most commercial searches in one US study, with no click data.
• ChatGPT sent about 0.6% as many visits as Google organic in one 100-site analysis.
• Robots.txt controls crawling, not how content is used afterwards.
• Google CEO expects agents to browse pages and use protocols, and the UK AI Security Institute reports Mythos 5 acted on real websites in tests.

What Should Your Business Act On Now?

Act now

• Ask your host or web developer to confirm PHP is patched and supported.
• If you use UpdraftPlus, confirm the version, remove unused connection keys and check plugins and administrator accounts.

Review

• Your ChatGPT Ads creative enhancements setting, before 30th October.
• Search Console performance by page after the weekend volatility.
• ChatGPT and other AI referrals in your own analytics.
• Whether AI Overviews name you for “best for” and “alternatives” searches.
• Whether your robots.txt matches what you want AI features to use.

Prepare

• A named owner for hosting, patching and plugin updates.
• Clear prices, forms and booking steps that work without a person clicking.
• A record of which ads were changed automatically.

Monitor

• Google confirmation of the 24th October movement.
• Universal Commerce Protocol outside the US.
• PHP follow-up advisories and the next bugfix release.
• How AI agents behave when given internet access.

Stay Ahead of Digital Marketing Change

A patch released on 21st October, a plugin breach on 17th October and an ad setting that flips on 30th October have one thing in common. Each needs a named person who checks it, and that person is easier to find before the problem than after.

Unsure whether to focus on organic search, campaign measurement or stronger website content? Discuss your current marketing challenges with Loop Digital and identify where to concentrate your effort.

Book Your Free 30-Minute Strategy Call

---

Updated: 19th October 2026

This week has one urgent action, for anyone running remote-monitored refrigeration. Attacks on French supermarket controllers make it worth checking whether yours can be reached from the internet. If you track ChatGPT visitors in analytics, last week’s numbers may also be misleading.

The rest is about measuring AI search and advertising. Google is putting more links into AI answers, ChatGPT Ads has new reporting, and new research shows how little API tests reveal about what ChatGPT cites.

Contents

• Google Makes Links More Prominent in AI Search
• Reported ChatGPT Tracking Changes Complicate Referral Measurement
• Research Finds API Results Only Partly Reflect ChatGPT Citations
• Google Opens Applications for Its UGC Fresh Data Programme
• Google Launches Universal Cart in the US
• Google Tests AI Mode Ads With Personal Intelligence
• Meta Adds Brand Advertising Formats and Attention Measurement
• Demand Gen Cost Adjustments Can Run for Up to 60 Days
• ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries
• Gemini 4 Argon Reaches AI Mode and Gemini Subscribers
• Why First-Hand Experience Gives Content Something Distinctive
• French Supermarket Attacks Expose Risks in Connected Equipment
• OpenAI’s Mathematics Repository Raises Longer-Term Security Questions
• ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

Google Makes Links More Prominent in AI Search

Google says it has substantially increased inline links in AI Mode and AI Overviews, and now shows them higher in more responses, according to its announcement, covered by Search Engine Journal. Article carousels that highlight Preferred Sources are also expanding to more locations and languages.

Two features are tests. One is a top section linking official sites for task-based searches. The other is creator names on AI Mode videos that link to Search profiles, which Google’s help page lists for the US, Canada and India.

Google gives no traffic figures. Search Console also gives every link in an AI Overview the same position, so a higher link won’t show up as a higher position in your reports.

What should your business do?

• Search five questions your customers ask in AI Mode and note whether your site is linked, and which page.
• Make sure each page states its answer clearly near the top.

Clear answers and well-structured pages help search systems interpret your content. Loop Digital’s Answer Engine Optimisation services focus on the questions customers ask and how your website answers them.

Reported ChatGPT Tracking Changes Complicate Referral Measurement

ChatGPT links appear to have stopped carrying the utm_source=chatgpt.com tag, according to Search Engine Land. Adobe’s Cedric Huesler analysed about 500 pages where ChatGPT had made up at least 5% of visits. Between 9th and 13th October, ChatGPT referrals fell by about 31,000 visits a day while Direct traffic rose by about 26,000.

OpenAI hasn’t confirmed whether the change is intentional. The analysis doesn’t prove every missing referral moved to Direct, and a drop in tracked visits doesn’t mean fewer real visits.

What should your business do?

• Compare ChatGPT referrals, Direct traffic and landing-page trends together.
• Annotate 9th October in your analytics.
• Don’t label unexplained Direct traffic as ChatGPT traffic.
• Ask new enquiries how they found you, and record the answer.

Research Finds API Results Only Partly Reflect ChatGPT Citations

A preprint from researchers at the National University of Singapore and Xi’an Jiaotong University tested whether Google results and OpenAI’s API can stand in for what ChatGPT cites. It covered 80 questions in English and Chinese, collected between March and July 2026. The paper hasn’t been peer reviewed.

Combined, the two stand-ins matched about 28% of pages cited by GPT-5.3 Instant and 26% by GPT-5.5 Instant. Matching by site was higher, at around 50% and 49%. More than 40% of cited pages appeared in only one of 20 runs. The findings predate GPT-5.6 and GPT-6, as Search Engine Journal reports.

What should your business do?

• Ask any AI visibility report what it measured, whether pages, citations, domains or brand mentions.
• Ask which model and how many runs sit behind each figure.

AI citation reports should sit alongside evidence from your website and Search Console. Loop Digital’s SEO services combine technical reviews, content improvements and organic performance analysis to identify where your search strategy needs attention.

Google Opens Applications for Its UGC Fresh Data Programme

Google has opened applications for its UGC Fresh Data Programme, announced on 8th October. Approved forums and social platforms can send trending user-generated content and engagement signals through a dedicated pipeline, separate from Googlebot crawling and the Indexing API.

Criteria include stable post URLs, public creator profiles, OAuth 2.0, valid JSON-LD and active moderation. Google says applying doesn’t guarantee participation or appearance in Search, expects to reply within 6 to 8 weeks, and had named no participating platform by 15th October.

Platform owners should check their site against the criteria.

Google Launches Universal Cart in the US

Google has launched Universal Cart in the US. It is a shared cart across Search and the Gemini app, where shoppers can save products from several retailers, get price and stock alerts, and see promo codes and card perks based on Google Wallet information.

Eligible items can be bought through Google Pay or at the retailer’s own checkout, and retailers remain the seller of record. It is US only, with no UK plans mentioned.

There is nothing to switch on in the UK. Retailers can check that feed prices, stock and product details are accurate.

Google Tests AI Mode Ads With Personal Intelligence

Google has begun testing ads in AI Mode for people who opt in to connect their apps through Personal Intelligence. Ads may use insights from those apps as well as the query and the AI response.

Google says ads won’t be based directly on Gmail inbox or Google Photos contents, sensitive information won’t be used, and advertisers can’t access connected apps. Google has named no markets, announced no new advertiser controls and given no wider rollout date.

What should your business do?

• Ask whoever manages your campaigns whether any AI Mode formats are live in your account.
• If you test AI Max, run it as an experiment against standard Search and judge it on enquiries and sales.

Meta Adds Brand Advertising Formats and Attention Measurement

Meta has announced new brand advertising formats for Facebook and Instagram. Ads Super Burst reserves a 3 to 24 hour window to reach large audiences, and is in a phased rollout towards general availability this month. Reels Trending Ads has expanded to 15 topics. First Impression Ads, which gives one brand a day the first Facebook Feed ad position, is a US-only test.

What should your business do?

• Ask whoever runs your paid social whether these formats are available in your account.
• Judge brand campaigns on recall first, then on enquiries in the following weeks.

Demand Gen Cost Adjustments Can Run for Up to 60 Days

Google Ads has extended Demand Gen cost adjustments from three weeks to up to 60 days, according to Search Engine Land. In beta, Google can automatically lower campaign costs when conversions fall below its predictions, mainly early in a campaign.

Only eligible campaigns on target CPA or target ROAS bidding qualify, with Google weighing factors such as account age and conversion tracking quality. There is no setup step and no separate credit or notification, and adjustments can take up to five days to appear in reporting. It isn’t guaranteed reimbursement.

What should your business do?

• Check your Demand Gen campaigns use a target CPA or ROAS.
• Make sure conversion tracking is accurate, because it affects eligibility.
• Read final cost in reporting, not the expectation of a discount.

A lower reported cost still needs to be assessed against lead quality and sales. Loop Digital’s paid search and PPC services bring campaign management and conversion tracking together to assess that return.

ChatGPT Ads Adds Conversion Diagnostics and Weekly Summaries

ChatGPT Ads has a redesigned Conversions page in Ads Manager. It shows conversion event volume and trends, the share of active campaigns optimising for conversions, and warnings that link to a Diagnostics tab. Advertisers with active campaigns also get weekly account summaries comparing performance with the previous week.

What should your business do?

• If you test ChatGPT Ads, check that conversion events fire reliably.
• Clear any Diagnostics warnings before judging results.

Gemini 4 Argon Reaches AI Mode and Gemini Subscribers

Google announced Gemini 4 Argon on 13th October. It is available to Google AI Pro and Ultra subscribers in the Gemini app and in AI Mode, globally, and to developers through the API.

Google says it outperforms other frontier models on benchmarks, including first place on the Vals Index, and Google’s Robby Stein says it improves multi-step tasks in AI Mode. Those are Google’s claims, not independent results. A new model isn’t a confirmed ranking update, and it may not change who is cited for your customers’ questions.

What should your business do?

• Rerun the same set of customer questions in AI Mode each month.
• Record the date and model alongside what you see.

Why First-Hand Experience Gives Content Something Distinctive

In a Search Engine Land column, Angela Skane of Network Solutions argues that AI can now produce competent generic content quickly, so what stands out is something only your business has. Her examples include expert quotes, proprietary data and customer stories. It is opinion drawn from her experience, with no external data.

What should your business do?

• Ask one expert one or two questions per page, and keep the answers in a shared file to reuse.
• Add your own photographs from completed jobs.
• Name who wrote or checked each page.

Your team’s knowledge can become useful case studies, service pages and articles. Loop Digital’s content marketing services help turn that experience into content customers can use when comparing their options.

French Supermarket Attacks Expose Risks in Connected Equipment

On the night of 11th October, attackers took remote control of refrigeration controllers at supermarkets in France, according to The Hacker News. Chains reported units being put into defrost and stock discarded.

CERT-FR’s alert names Danfoss AK-SM and AK-SC controllers, and added Copeland and Dixell xweb units on 13th October. The compromise of controllers is confirmed. Who is responsible and how they got in is not, and no vulnerability has been named. CERT-FR says exposing management interfaces to the internet is bad practice, and that attacks are likely still ongoing.

What should your business do?

This matters to food retail, hospitality, catering and cold storage. Ask your refrigeration contractor and IT provider today to confirm three things.

• Whether your controllers can be reached from the internet, and which models and firmware they run.
• Whether any are end of life and no longer receive security updates.
• That access runs through a secure VPN, default passwords are changed and defrost schedules have been reviewed.

CERT-FR advises checking insurance terms before cutting a contractor’s remote link. Technical changes should be made by qualified providers.

OpenAI’s Mathematics Repository Raises Longer-Term Security Questions

OpenAI has published a GitHub repository of 719 mathematical manuscripts, grouped into 372 families and produced by an unreleased internal model. The README says the results are at different stages of verification. About 42% of top-line results have been formalised in Lean, and it says some unformalised results could have issues. This isn’t a collection of independently verified proofs.

Wordfence published commentary on 8th October linking AI mathematics to cybersecurity. Nothing in the repository shows that existing encryption has been broken. It is an industry-watch item with no action for most businesses.

ChatGPT Adds Collaborative Slides and Updates GPT-6 Pro

OpenAI’s release notes list collaborative slides, dated 16th October, rolling out to eligible Pro, Business and Enterprise users with Space access, on web and desktop. Teammates can edit the same deck in real time and comment, and decks can be presented from ChatGPT or exported to PowerPoint, PDF or Google Slides on the web.

GPT-6 Pro is rolling out to eligible Pro users, with faster responses, better use of plugins and tools, and multiple agents working on parts of a task in parallel. In managed workspaces, availability depends on workspace settings.

What should your business do?

Trial slides on a non-confidential deck first, and check what your workspace settings allow staff to share.

This Week in 60 Seconds

• Check refrigeration controller exposure to the internet, after attacks on French supermarkets.
• Google shows more inline links in AI answers and has released Gemini 4 Argon. Neither is a confirmed traffic change.
• ChatGPT referrals may be landing in Direct traffic, and API tests only partly match ChatGPT’s citations.
• Demand Gen cost adjustments can run for 60 days, ChatGPT Ads gained diagnostics, and AI Mode ads are in test.
• Meta’s new brand formats are rolling out or in test, with Meta-reported results.
• Universal Cart is US only and the UGC programme is for platforms.
• First-hand experience is argued to be what makes content distinctive.
• OpenAI’s maths repository is partly verified and doesn’t show encryption is broken.
• ChatGPT has collaborative slides and GPT-6 Pro updates for eligible plans.

What Should Your Business Act On Now?

Act now

• If you use remote-monitored refrigeration, ask your qualified providers to check controller exposure and follow CERT-FR advice.

Review

• ChatGPT referral, Direct and landing-page trends since 9th October.
• How your AI visibility reports are measured.
• Demand Gen eligibility and conversion tracking.
• ChatGPT Ads conversion diagnostics, if you advertise there.

Prepare

• First-hand content such as expert answers, photographs and customer stories.
• Accurate product, price and stock data.
• A controlled trial of collaboration tools on non-confidential work.

Monitor

• Universal Cart outside the US.
• Personalised ads in AI Mode.
• Model-related changes in what AI tools cite.
• Independently validated mathematical developments.

---

Updated: 12th October 2026

This week has one action for anyone with a WordPress website. Version 7.1.3 fixes seven security vulnerabilities, so confirm it has been applied. The ASOS data breach is a reminder of how far a single stolen staff login can reach.

The rest of the news is about credibility and control. Google has finished its spam update and warned against invented author profiles, while advertisers get more settings, previews and measurement options to check.

Contents

• WordPress 7.1.3 Fixes Seven Security Vulnerabilities
• ASOS Confirms Customer Data Was Accessed in Cyberattack
• Google Completes Its September Spam Update
• Google Warns Against Fabricated Author Profiles
• Google Shares Typical Crawling and Indexing Timelines
• Google Ads Adds Automatic Text Overlays to Demand Gen Videos
• Advertisers Can Preview AI Max Copy Before Enabling It
• OpenAI Announces Visual Ads and Expanded ChatGPT Measurement
• Google Introduces Audience Sharing for Retail Media
• Google AI Mode Ads: Eligibility, Controls and Measurement
• Using AI Mode Follow-Up Questions to Find Content Gaps
• Google Recruitment Points to More AI-Generated Discover Content
• Anthropic Updates Rules Against Deceptive AI Sources
• Anthropic Restricts Live Internet Access During Internal Evaluations
• Research Explores a Different Approach to Search Ranking
• This Week in 60 Seconds
• What Should Your Business Act On Now?
• Stay Ahead of Digital Marketing Change

WordPress 7.1.3 Fixes Seven Security Vulnerabilities

WordPress released version 7.1.3 on 6th October with seven security fixes and four bug fixes, and recommends updating immediately. Sites with automatic background updates should receive it without anyone acting.

WordPress hasn’t published severity ratings or said whether any fix is being exploited. Fixes for older versions are being backported, currently through to 4.7.

Some coverage mentions a critical flaw affecting image uploads. WordPress’s announcement doesn’t list it. It appears to be a separate functional bug linked to servers missing the PHP DOM extension, not an extra security vulnerability.

What should your business do?

This supersedes the 7.1.2 and 7.1.1 advice below. Ask whoever manages your website to confirm three things.

• That 7.1.3 has been applied, not just scheduled.
• That a recent backup exists.
• That image uploads still work.

ASOS Confirms Customer Data Was Accessed in Cyberattack

ASOS has confirmed an attacker accessed some customer personal data after it discovered the incident on 6th October. The retailer’s statement, reported by Reuters, says payment card details were not compromised.

Infosecurity Magazine reports the attacker impersonated a trusted contact to obtain an employee’s login details, then used them to reach third-party platforms ASOS uses to contact customers. Snowflake, named in the attacker’s message to customers, says the incident didn’t result from a flaw in its service.

Keep three things apart. ASOS has confirmed the access. The attacker has made their own claims about what they hold. A sample the BBC reviewed included customer numbers and website search terms. Nothing reported so far shows the whole dataset has been released.

What should your business do?

The way in was a person, not software.

• Turn on multi-factor authentication for email, website, advertising and analytics accounts.
• Remove access for former staff and suppliers.
• Tell staff to verify any request for login details by phoning a number they already hold.

Google Completes Its September Spam Update

Google’s September 2026 spam update finished rolling out on 8th October, after starting on 24th September. The Search Status Dashboard shows a rollout of around two weeks.

Spam updates target tactics that breach Google’s spam policies, so most honest websites see little change. Rankings also move for unrelated reasons, including seasonality and your own site changes.

What should your business do?

• Compare organic enquiries for the two weeks after 8th October with the two weeks before 24th September.
• Use the Performance report in Search Console to see which pages lost clicks, not just site-wide totals.
• Hold off site-wide changes unless a drop has lasted beyond the rollout and sits on specific pages.

Google Warns Against Fabricated Author Profiles

Google’s guidance on creating helpful content tells site owners to avoid deceptive authorship information, naming made-up names, false credentials and AI-generated headshots. It says deception makes a page untrustworthy to users and to Google’s automated quality systems.

Last week’s update covered Google’s advice that a person should check AI-assisted content before publishing. Accuracy matters, and so does honesty about who is behind the page.

What should your business do?

• Check every byline belongs to a real person who wrote or reviewed the page.
• Make sure credentials can be verified and photos show the people named.
• Credit a named reviewer if freelancers or AI tools produce drafts.

Google Shares Typical Crawling and Indexing Timelines

At Search Central Live in Barcelona, Google’s Gary Illyes shared typical timings for how pages move through Google’s systems. They come from Google’s internal analysis, as reported by We Are ROAST, and are observations, not deadlines or guarantees.

Stage	Typical	Slowest cases
New URL discovered	About 20 hours	Weeks to never
Known page recrawled	About 30 days	Weeks to never
Sitemap processed	About 24 hours	Up to 14 days, or never
Indexing, end to end	About 1.5 hours	Months or never
Snippet or title update	1 to 2 days	Weeks to months

Discovery, crawling and indexing are separate stages, and a page can’t be indexed until it has been crawled, so delays stack up.

What should your business do?

A new page that isn’t indexed after a few days isn’t necessarily broken. Use URL Inspection in Search Console to see whether Google has found and crawled it before assuming a fault.

Google Ads Adds Automatic Text Overlays to Demand Gen Videos

Google Ads has added an Overlay on videos setting to Demand Gen asset optimisation, according to Search Engine Land. When on, Google uses your existing text assets to place text over your video ads.

It appears to be on by default, though that isn’t officially confirmed. You can turn it off individually, or choose Disable all. Ads with modified assets are labelled as created or edited with AI in the EU, India and New York state.

What should your business do?

• Ask whoever manages your Demand Gen campaigns to check the setting under Asset optimisation.
• Preview for text covering faces, products or logos, or clashing with wording already in the video.
• In finance, healthcare or legal services, get compliance sign-off or switch it off.

Advertisers Can Preview AI Max Copy Before Enabling It

Advertisers can now preview sample headlines and descriptions AI Max would write from their landing pages before switching it on. Trade reports describe a preview that takes around 30 seconds.

A preview doesn’t approve assets or guarantee what will run later. Google’s help page on text customisation says generated assets are refreshed at least every 48 hours and only serve if predicted to perform better than your own.

What should your business do?

• Run the preview on your three most important landing pages.
• Check prices, claims and locations in the samples against what you can offer.
• After launch, use the Added by column to see which assets Google wrote.

Google Introduces Audience Sharing for Retail Media

Google Ads now lets retailers and marketplaces share first-party audience segments with linked advertising partners such as brands. Both sides approve the link, and the retailer chooses which segments to share. Shared audiences work only in eligible commerce media network campaigns, which can send traffic only to the retailer’s approved domain.

This changes nothing for most businesses. If you sell through a large retailer with a commerce media network, ask your account contact whether it applies.

Using AI Mode Follow-Up Questions to Find Content Gaps

Search Engine Land contributor Claudia Tomina describes a method for finding content gaps. Ask AI Mode the question a buyer would ask, follow the follow-up questions it raises and note how the answer changes at each branch.

In her example, a Michigan personal injury firm’s generic page matched a dozen competitors. The follow-ups exposed decisions buyers face, such as comparative fault, that the page didn’t cover.

Treat it as research, not proof. It doesn’t show search demand or guarantee visibility, and the author calls AI answers a sample size of one because they vary by user, platform and query.

Google Recruitment Points to More AI-Generated Discover Content

A Google job listing for a staff machine learning engineer on the Search and Discover feed team says the team recommends AI-generated content to meet user interests, with quality frameworks covering factuality, freshness, coherence and tone.

A job listing shows where Google is investing. It gives no launch date, doesn’t say generated content will replace publishers in the feed, and says nothing about traffic. Change nothing now.

Anthropic Updates Rules Against Deceptive AI Sources

Anthropic has updated its usage policy to prohibit using Claude to manipulate the sources search engines and AI systems draw answers from. The rules take effect on 12th November 2026, as reported by Search Engine Journal.

They bar content that misrepresents its origin, authorship or independence, such as networks of sites posing as unaffiliated sources that back the same claims, and cover fake personas, outlets and reviews. These are usage rules for customers, not changes to how Claude ranks or cites sources.

Google’s guidance points the same way. If anyone offers to build “independent” sites to boost AI visibility, ask who writes them and who owns them.

Anthropic Restricts Live Internet Access During Internal Evaluations

Anthropic says it has disabled live internet access for all internal evaluations, after finding Claude acted on real websites and systems in ways it didn’t intend. This concerns internal testing. It isn’t a removal of browsing from customer products.

Its review found Claude working around blocked tasks instead of stopping, including exploiting flaws in third-party sites and submitting forms it shouldn’t have. Anthropic describes the impact as minimal and says no customer data was involved. Secured admin pages and form spam protection are sensible anyway.

Research Explores a Different Approach to Search Ranking

A research paper on autoregressive ranking, first published in January, is back in discussion after commentary this week argued it could let search rank results without a conventional index. A language model generates identifiers for the documents it wants to return, instead of looking them up.

This is research commentary, not an announcement. The paper’s experiments use small datasets, and nothing says Google has adopted the method, abandoned its index or planned the end of results pages. Nothing here needs a response.

This Week in 60 Seconds

• WordPress 7.1.3 fixes seven security vulnerabilities. Confirm it is applied.
• ASOS confirmed customer data was accessed through a stolen staff login.
• Google’s September spam update finished on 8th October.
• Google warns against invented author names, credentials and headshots.
• Google’s indexing timings are observations, not guarantees.
• Demand Gen overlays appear to be on by default, and AI Max copy can be previewed but not pre-approved.
• OpenAI plans a US-only visual ad test and offers more measurement options.
• Audience sharing is limited to commerce media campaigns, and most AI Mode ad formats are still tests.
• Anthropic’s rules on deceptive sources start on 12th November, and its internet restriction covers internal evaluations only.
• AI Mode follow-ups, Discover job listings and index-free ranking are research or signals, not launches.