The Weekly Drilldown: A WordPress Plugin Breach Hits Home, Meta Rewards Fresh Posts, and AI Overviews Take Over Commercial Searches

Every week, the MSP team breaks down the dental marketing news that actually matters, from Google updates and AI search changes to social media trends, SEO shifts, and reputation management surprises.

• UpdraftPlus WordPress plugin security breach enables backdoor attacks
• Meta offers insights on individual platform growth
• Instagram chief says stronger AI slop prevention is needed
• Google AI Overviews nearly double on commercial keywords
• Quick hit: Google Business Profile review appeals are delayed
• Quick hit: Meta delays its new business terms to November 20
• Quick hit: Google adds brand management tools to Gemini

What happened: Attackers broke into the website of TeamUpdraft, the company behind the UpdraftPlus backup plugin, on October 17 and 18. They likely got into a customer database holding connection keys for UpdraftCentral, a remote management feature. Using those stolen keys, the attackers sent commands that looked legitimate to connected WordPress sites. Those sites then installed malicious plugins and created unauthorized Editor accounts that were quietly given administrator-level permissions. The backdoor even slipped past two-factor authentication and login attempt limits. Security firm Patchstack identified 99 different names used for the fake plugins, including innocent-sounding ones like “Site Health Cache.”

UpdraftPlus is installed on more than 3 million sites, but only sites with an active UpdraftCentral Cloud connection were exposed. The catch is that connection can exist even if the site owner never meant to use remote management, because the option was enabled by default. Fixed versions (1.26.13 for free, 2.26.13 for premium) came out October 19. The article does not say how many sites were actually compromised.

Why dentists should care: A huge number of dental practice websites run on WordPress, and plenty of them have a backup plugin quietly doing its job in the background. A hacked site can redirect visitors, show spam, or hand attackers a door into anything connected to your website. The part that trips people up is that updating the plugin shuts the door going forward, but it does not remove anything that was already planted.

What to do next:

• Ask whoever manages your website whether you use UpdraftPlus, and if so, whether it has been updated to 1.26.13 (free) or 2.26.13 (premium) or newer
• Have them remove any leftover UpdraftCentral connection keys (found under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral)
• Check your list of installed plugins for anything unfamiliar, and your user list for administrators nobody recognizes
• Change administrator passwords, and restore from a backup made before October 17 if anything looks off
• If you do not know who manages your website, this is a great week to find out. Our website design team can help take a look

What happened: In its latest earnings update, Meta shared a bunch of details about how its platforms are surfacing content. On Instagram, time spent per user hit an all-time high, and nearly 45% of recommended Reels are now less than a day old, up more than 11 percentage points from last quarter. Most Reels engagement is also bunching up in the first day after posting. Meta’s upgraded model now ranks sequences of Reels together instead of scoring each one separately. On Facebook, Reels time spent hit an all-time high and grew double digits year over year, and a new recommendation system is now live on roughly a quarter of unconnected Feed views and half of Reels views. Threads has passed 500 million monthly users, and Meta’s Creator Marketing Hub is now open to all advertisers.

Separately, Instagram chief Adam Mosseri said in his weekly Q&A that “We do not throttle the reach of AI content just for being AI content.” He also said Instagram plans to add more AI labels, encourage creators to tag AI-generated posts, and find a way to protect creators from people using AI to copy their work.

Why dentists should care: The big takeaway is that fresh, original social media content is winning. If nearly half of what Instagram recommends is less than a day old, a post that goes up regularly has a better shot than one that has been collecting dust. It also lines up with what we said in earlier issues about platforms getting pickier with low-effort AI content. AI-assisted is fine, copied or generic is not.

What to do next:

• Post consistently, even if it is just a few short Reels a week, because recency matters
• Shoot original content with your real team and real office (with patient permission where needed), like quick tips, tours, and behind-the-scenes moments
• Pay attention to how a post does in its first 24 hours, since that is where most of the action happens
• If you use AI tools for captions or ideas, keep a human touch on top, and consider tagging AI-generated visuals
• Don’t forget Threads and Facebook Reels. Both are growing, and your social media team can help decide where to focus

AI Overviews Are Now on Almost Every Commercial Search (in Semrush’s Data)

What happened: A new Semrush study tracked 400 commercial keywords in the U.S. and found Google AI Overviews appearing on 88% of them in August 2026, up from about 46% in September 2025. Weighted by search volume, the figure was over 97%. The biggest jumps were in searches with words like “reviews” (up from about 30% to 89%), “best X for Y” (up to about 96%), “alternatives” (about 83%), and price or cost (about 82%).

The keywords came from banking, software, and ecommerce, not dental or local search. The data covers U.S. desktop only, only shows whether an AI Overview appeared (not whether anyone clicked), and comes from a company that sells tracking tools. The category sizes are small, so individual keywords can swing the numbers.

Why dentists should care: We can’t say dental searches look just like these, but the types of searches that jumped are the kind patients use: “best dentist for anxious patients,” “dental implant cost,” “Invisalign alternatives,” and “[practice name] reviews.” If AI Overviews are heading toward nearly every commercial-style search, the answer a patient sees at the top may be written from your website, your reviews, and your listings before they ever scroll to the blue links.

What to do next:

• Make sure your website has clear pages for your main services, with straightforward answers on cost ranges, process, and who each treatment is for
• Keep your review profiles active and your responses professional, since “reviews” searches are growing fast in AI answers
• Make sure your practice details are the same on your website, Google Business Profile, and directories
• Check Search Console’s AI impressions report for your own numbers, as we covered earlier this year

What Jumped Most (Semrush Study, Sept 2025 to Aug 2026)

Google confirmed that appeals for review-related issues, like asking to remove a fake or policy-breaking review, are taking longer than usual because of a high volume of requests. A Google team member said it cannot give a timeframe for pending cases, and asked people not to file duplicate appeals, since submitting more does not move you up the line. If you are waiting on an appeal, resist the urge to resubmit and keep encouraging real patients to share their experiences in the meantime. Our reputation management team can help if a review situation is getting complicated.

Last issue we mentioned Meta’s updated terms and the crawling language that raised eyebrows. Meta has now moved the effective date for its updated Commercial Terms and Self-Serve Ad Terms from October 30 to November 20, saying it wants “more time for us to explain to our partners and stakeholders what’s changing and what’s not.” The crawling permission that drew complaints is still in both agreements, and complaints to EU and UK regulators are ongoing. Nothing changes in your day-to-day, but it is a good reminder to have your web team check your robots.txt file before the new date.

Google added business features to Gemini, including a refreshed business page, the ability to connect Google profiles for more tailored insights, integrations with apps like Canva, Adobe, Dropbox, and Shopify, and tools for creating on-brand visuals from uploaded logos, fonts, and colors. It can also turn spreadsheets and receipts into charts and financial graphics. The article does not say who can use it, when it is rolling out, or what it costs, so there is nothing to do yet. If you try it, think carefully before connecting anything with patient or sensitive financial information.

This week is a good reminder that the unglamorous basics matter just as much as the shiny new AI features. A backup plugin breach shows that website security needs someone paying attention, even when everything seems fine. Meta’s numbers say consistent, original content is working. And the Semrush study (with its caveats) suggests that the answers patients see about reviews, costs, and “best of” searches are increasingly assembled by AI from what your practice has already published. The practices that do well are the ones whose websites, reviews, and social channels all tell the same accurate story, and whose websites are locked down.

• UpdraftPlus WordPress plugin security breach enables backdoor attacks – Search Engine Journal
• Meta offers insights on individual platform growth – Social Media Today
• Instagram chief says stronger AI slop prevention is needed – Social Media Today
• Google AI Overviews nearly double on commercial keywords – Search Engine Land
• Google AI Overviews now hit 88% of tracked commercial keywords, Semrush finds – PPC Land
• Google review-related appeals delayed – Search Engine Land
• Google Business Profiles review appeals are delayed again – Search Engine Roundtable
• Meta delays business terms crawling – Search Engine Journal
• Google adds brand management tools to Gemini – Social Media Today

Adrian Lefler is the CEO and Co-Founder of My Social Practice and a recognized dental marketing expert with nearly two decades of experience. He is a trusted voice in dental marketing, AI in dentistry, and emerging technology, and he hosts BYTE SIZED, a podcast focused on dental AI, innovation, and technology.