Skip to main content
The Forge dispatch

A few things worth knowing.

The Dispatch brings you the articles we published over the past week, with a short introduction and a link to each story. Web, apps, and AI, together in one weekly email. If there’s nothing new, we’ll skip that week. Browse sent issues below, or explore our clearly labeled sample.

Sample issue

Assembled from September 2026 coverage

These examples come from The Forge's earlier coverage. Each weekly email links to the articles published during the previous week, with a short introduction to help you choose what to read.

  1. News

    Three WordPress plugins shipped remote code execution fixes

    Between early July and August 20, Super Forms, Elementor Pro and All-in-One WP Migration each fixed a flaw that let a stranger run code on the server. Wordfence reports two of them under active attack.

    Do you need to act? If you run one of them, update today: Super Forms 6.3.314, Elementor Pro 4.2.2, All-in-One WP Migration 7.110 or later. Then check your uploads folder for PHP files that shouldn't be there, because the update alone won't remove one.

    Our read: The three bugs matter less than the pattern. Every plugin is code you didn't write and can't read, and deleting the ones you don't use is the cheapest fix available.

    What happened, with primary sources
  2. From the Build

    A page the build called static served none of its words

    We built the same page three ways in Next.js 16.3.4, plus a common mistake and its fix, and measured all five. They shipped almost the same JavaScript. One route the build labeled static served none of its content as HTML, because of a Suspense boundary we'd added to fix a build error. Nothing warned us.

    Do you need to act? Fetch your own page with curl, strip the script tags, and look for your words. If they're missing, crawlers and slow phones are waiting on JavaScript to see them.

    The test, the code and the numbers
  3. From the Build

    Error messages matter more for assistants than for people

    When our MCP server refused a request for an ordinary reason, like a missing field or a file that was too big, it told the assistant the service was temporarily unavailable. An assistant that thinks you're down just tries again.

    Do you need to act? If you run anything an AI assistant calls, pass the real reason through, and say "unavailable" only when something on your side is actually broken.

    What else we learned building one
  4. Analysis

    Homeowners already want an instant price

    In Housecall Pro's survey of 1,040 U.S. homeowners, 93% said instant estimates influence who they hire, and 53% said they're comfortable with AI handling first inquiries.

    Our read: The assistant is the easy part. The hard parts are pricing you can trust, money that waits for a person to say yes, and keeping customer addresses out of the chat.

    Running a home service business by text
Tempered steel shading from gold to peacock blue, the sharper thinking The Forge newsletter brings on the web, apps and technology
The Forge dispatch

Stay ahead.
Build what’s next.

Your weekly roundup from The Forge: the articles we published over the past week on web, apps, and AI, with a short introduction and a link to each story. If we haven’t published anything new, we’ll skip that week.

Loading signup…

Prefer a feed reader? Follow via RSS