Weekly Digest: Apr 20-Apr 27

This week had a clear through-line: the AI giants are reshaping the stack underneath us while the WordPress underbelly keeps reminding everyone that plugins are still the soft spot. OpenAI and Microsoft renegotiated their deal, Meta got slapped down in China and signed up for solar from space in the same news cycle, and WPScan logged another round of plugin vulnerabilities that hit sites with hundreds of thousands of installs. Meanwhile the n8n and Ollama repos keep climbing, which tells me where serious builders are spending their time. Here’s what I actually paid attention to.

AI & Automation

OpenAI and Microsoft amended their partnership terms, which matters less for the press release language and more for who controls what when AGI gets declared (OpenAI).
An analyst is floating an OpenAI phone with agents replacing apps by 2028, which I’d file under “interesting if true” but worth tracking because it’s the most concrete agent-first hardware rumor yet (TechCrunch AI).
China vetoed Meta’s $2B Manus acquisition after a long probe, which is a real setback for Zuckerberg’s agent push and a reminder that AI M&A now runs through geopolitics (TechCrunch AI).
Google and Kaggle reopened registration for the 5-Day AI Agents Vibe Coding intensive, which is one of the few free courses I’d actually block time for if you’re trying to ship agents this year (Google AI).
Meta signed a contract for space-beamed solar power, which sounds like a parody headline but is a real signal of how desperate hyperscalers are for round-the-clock energy (TechCrunch AI).

Trending Code & MCPs

n8n crossed 185k stars and remains the workflow tool I recommend to anyone who wants automation without paying Zapier rent (GitHub).
Ollama keeps adding model support — Kimi-K2.5, GLM-5, gpt-oss — and is still the cleanest way to run local models on a workstation (GitHub).
everything-claude-code is a serious harness for skills, memory, and security across Claude Code, Codex, and Cursor, and it’s worth a look if you’ve outgrown vanilla agent setups (GitHub).
prompts.chat (formerly Awesome ChatGPT Prompts) hit 160k stars and is now self-hostable, which finally makes it usable for teams that can’t paste prompts into a public site (GitHub).
The Google Sheets MCP server crossed 51k installs on Smithery — boring on the surface, but spreadsheet I/O is where most real automation actually lives (Smithery).

Side Hustles

Failory’s roundup of the 27 most successful Shark Tank products is a useful reality check on how few “viral” pitches actually become durable businesses (Failory).
Their list of 34 failed Google products is the better read of the two, because it shows that distribution and capital don’t save a product nobody wants (Failory).
The Vinted business model breakdown is worth studying if you’re thinking about marketplaces — their no-fee-for-sellers model is doing what eBay couldn’t (Failory).
Failory also dropped a 235-firm SaaS VC database, which is the kind of cold-outreach raw material most founders pay for (Failory).

WordPress Pulse

WPScan caught attackers installing php-everywhere as a persistence mechanism in the LiteCache and WP-Automatic campaigns; the plugin was closed April 25, but if you have it installed, remove it now (WPScan).
An object injection bug was patched in SEOPress 7.9 — 300k+ active installs, so update before you finish your coffee (WPScan).
Profile Builder had an unauthenticated privilege escalation flaw across 50k+ sites, which is about as bad as it gets for a membership plugin (WPScan).
TI WooCommerce Wishlist still has an unpatched SQL injection at 100k+ installs, with no vendor response — disable it until that changes (WPScan).

Next week I’m watching whether the OpenAI-Microsoft amendment kicks off a wave of clarified AI partnership terms, and whether the WP-Automatic malware campaign keeps mutating now that php-everywhere is closed. I’m also rebuilding part of my research workflow on top of n8n plus the Sheets MCP, and I’ll write that up once it survives a week of real use.