--- title: "React 19 lands in WordPress, FROST attack fingerprints users via SSD timing" url: https://daily.dev/posts/react-19-lands-in-wordpress-frost-attack-fingerprints-users-via-ssd-timing-7zkht98s5 source_url: https://daily.dev/posts/react-19-lands-in-wordpress-frost-attack-fingerprints-users-via-ssd-timing-7zkht98s5 type: freeform source: "Web Digest" published: 2026-05-28T04:17:43.512Z updated: 2026-05-28T04:18:02.466Z tags: ["security", "react", "wordpress", "malware"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # React 19 lands in WordPress, FROST attack fingerprints users via SSD timing **[Web Digest](https://daily.dev/sources/webdev_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A developer-focused roundup covering four main stories: WordPress is upgrading to React 19 in Gutenberg 23.3 with several removed APIs requiring plugin developer migration; a new browser fingerprinting attack called FROST exploits SSD I/O timing via the Origin Private File System API to identify open tabs and apps without user interaction; a detailed malware attack analysis reveals a payload hidden in SVG files from a fake job assessment repo that exfiltrates credentials and establishes persistence; and Firefox 150 is testing a Smart Window mode with a built-in AI assistant accessing tabs and history. Notable items include Hologram v0.9, CSS anchor positioning workarounds, VS Code Agents window, a new JavaScript package manager with a 24-hour publish cooldown, and Android 17 mandatory adaptive resizability. ## Content **TLDR:** WordPress is shipping React 19 in Gutenberg 23.3, targeting WordPress 7.1, with several removed APIs that plugin developers need to migrate away from now. A new browser fingerprinting technique called FROST exploits SSD I/O timing through the Origin Private File System API to identify which tabs and apps a visitor has open. Firefox 150 is rolling out a Smart Window mode with a built-in AI assistant that can read your tabs and history. A developer also published a detailed breakdown of a malware attack hidden inside SVG files in a fake job assessment repo. --- ## React 19 upgrade in WordPress WordPress is moving from React 18 to React 19, landing first in Gutenberg plugin 23.3 and targeting WordPress 7.1. The removed APIs are the ones you'd expect: `ReactDOM.render`, `hydrate`, `unmountComponentAtNode`, and `findDOMNode` are all gone. `forwardRef` is deprecated in favor of passing `ref` as a regular prop, and `defaultProps` on function components no longer works — use ES6 defaults instead. TypeScript users have extra surface area to check: `MutableRefObject` is deprecated, and `ReactElement` props changed from `any` to `unknown`, which will surface type errors you may have been quietly ignoring. ## FROST: SSD timing attack via OPFS Researchers published a technique that uses JavaScript and the Origin Private File System API to measure SSD I/O contention timing. The result: a malicious site can infer which other websites you have open in other tabs — across different browsers — and which desktop apps are running, all with no user interaction beyond loading the page. No permissions prompt, no clicks. It's a good reminder that OPFS is a powerful API with a non-obvious attack surface, and one worth watching as browser vendors figure out how to respond. ## Malware hidden in SVG files via fake job assessment A developer received a fake job assessment over Discord pointing to a GitHub repo. The payload was split across base64-encoded HTML comments inside SVG image files, reconstructed and `eval()`'d at startup. It fingerprinted the machine, exfiltrated `.env` files, `.pem` keys, SSH keys, and browser credentials, downloaded Windows executables, and established persistence via a VBS file in the Startup folder. The full attack chain writeup is worth reading before you next clone an unfamiliar repo — the advice to audit before running anything is obvious in hindsight but easy to skip under interview pressure. ## Firefox Smart Window rolls out in beta Firefox 150 is testing a Smart Window mode for US and Canada users that adds a built-in AI assistant with access to your open tabs, browsing history, and current page. You can pick between Gemini 2.5 Flash Lite, Qwen3, or a 120B GPT model, or point it at a custom LLM endpoint. Chats are stored locally, and there's a toggle to block AI enhancements entirely. It's a more privacy-conscious take on browser AI than most, though giving any assistant access to your full browsing history is still a meaningful trust decision. --- ## Also notable - **Hologram v0.9** adds a realtime layer with typed identity channels and pub/sub fan-out in pure Elixir, plus patches for plug CVE-2026-8468 and decimal CVE-2026-32686. - **CSS anchor positioning** — the HTML `anchor` attribute was dropped from standardization; a workaround using `attr()` with data attributes and `` types can wire up multiple anchor associations from a single CSS rule. - **Framer editor pricing** dropped to $20/month across all plans, down from $40 on Pro and Scale. - **Solon AI** is an open-source code review tool built around JSON playbooks for Next.js, WCAG 2.2, OWASP Top 10, and AI-generated code patterns — runs diffs through Claude Haiku and posts PR comments. - **VS Code Agents window** is a new dashboard for managing multiple AI coding agent sessions across local, cloud, and remote environments, with Git worktree support for isolated work. - **Aube** is a new JavaScript package manager from the creator of Mise with a 24-hour cooldown on newly published packages as a security measure. - **Scroll-driven animations** — pure CSS fade-in/out using `animation-timeline: view()` with `animation-range-start` and `animation-range-end`, no JavaScript needed. - **CSS `content` property** supports alternative text for screen readers via a `/` separator — useful accessibility detail from Thoughtbot's dev roundup. - **Android 17** makes adaptive resizability mandatory for apps targeting API level 37, with new Jetpack Compose grid, flexbox, and media query APIs for the full device range. - **WarpDrive** is a lightweight, framework-agnostic data library from the Ember team with TypeScript support, SSR readiness, and reactive bindings across any framework. - **Expo Agent** research project added push notifications, media upload, and faster deployments this week, building on last week's Convex database and cross-platform auth additions. - **Brian Chesky (Airbnb)** argued that the future of AI interfaces isn't text-forward chatbots but visually rich agentic UIs — the iMessage-for-everything analogy is a decent framing for why generic chat interfaces fall short for complex domains. ## Similar posts on daily.dev - [React 19 Upgrade in WordPress](https://daily.dev/posts/react-19-upgrade-in-wordpress-s4ndgbrgd) · Make WordPress Core · 37 upvotes · 7 comments --- Tags: [#security](https://daily.dev/tags/security), [#react](https://daily.dev/tags/react), [#wordpress](https://daily.dev/tags/wordpress), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/react-19-lands-in-wordpress-frost-attack-fingerprints-users-via-ssd-timing-7zkht98s5)