Skip to main content
The Forge dispatch

A few things worth knowing.

The Dispatch is a short email, not a list of new posts. Each issue picks a few developments in web, apps, and AI, says what we make of them, and tells you whether you need to do anything. It arrives when there’s something worth your time, not on a schedule.

Sample issue

Assembled from September 2026 coverage

This is what an issue looks like. Each item says what changed, who it affects, and whether you need to do anything, then gives our read. Some come from the news. Some come from our own builds.

  1. News

    Three WordPress plugins shipped remote code execution fixes

    Between early July and August 20, Super Forms, Elementor Pro and All-in-One WP Migration each fixed a flaw that let a stranger run code on the server. Wordfence reports two of them under active attack.

    Do you need to act? If you run one of them, update today: Super Forms 6.3.314, Elementor Pro 4.2.2, All-in-One WP Migration 7.110 or later. Then check your uploads folder for PHP files that shouldn't be there, because the update alone won't remove one.

    Our read: The three bugs matter less than the pattern. Every plugin is code you didn't write and can't read, and deleting the ones you don't use is the cheapest fix available.

    What happened, with primary sources
  2. From the Build

    A page the build called static served none of its words

    We built the same page three ways in Next.js 16.3.4, plus a common mistake and its fix, and measured all five. They shipped almost the same JavaScript. One route the build labeled static served none of its content as HTML, because of a Suspense boundary we'd added to fix a build error. Nothing warned us.

    Do you need to act? Fetch your own page with curl, strip the script tags, and look for your words. If they're missing, crawlers and slow phones are waiting on JavaScript to see them.

    The test, the code and the numbers
  3. From the Build

    Error messages matter more for assistants than for people

    When our MCP server refused a request for an ordinary reason, like a missing field or a file that was too big, it told the assistant the service was temporarily unavailable. An assistant that thinks you're down just tries again.

    Do you need to act? If you run anything an AI assistant calls, pass the real reason through, and say "unavailable" only when something on your side is actually broken.

    What else we learned building one
  4. Analysis

    Homeowners already want an instant price

    In Housecall Pro's survey of 1,040 U.S. homeowners, 93% said instant estimates influence who they hire, and 53% said they're comfortable with AI handling first inquiries.

    Our read: The assistant is the easy part. The hard parts are pricing you can trust, money that waits for a person to say yes, and keeping customer addresses out of the chat.

    Running a home service business by text
Tempered steel shading from gold to peacock blue, the sharper thinking The Forge newsletter brings on the web, apps and technology
The Forge dispatch

Stay ahead.
Build what’s next.

A few developments in web, apps, and AI, what we make of each, and whether you need to act. Sent only when there’s something worth your time.

Prefer a feed reader? Follow via RSS