LabraSEO

PHP2Shell patch 🔐, Google Discover freshness filter 🧹, GEO traffic reality check 📊

Issue 20, 22 October 2026

What changed in search and AI answers, for marketing teams, in five minutes.

Headlines & Launches

PHP2Shell patch is urgent, Google explains what to do if you take your site offline (5 minute read)

A critical PHP vulnerability called PHP2Shell is pushing many site owners to patch urgently, with some, including European government and hospital sites, going offline entirely while they fix it. Google's John Mueller offered guidance on handling Search during the downtime. If your developer or host takes your site offline to patch this, make sure they follow Google's advice so rankings recover cleanly once you're back.

Google reveals the freshness filter that has shaped Discover for two years (4 minute read)

Google published research on Supersession-Decay Filtering (SDF), a system that quietly strips stale articles from Google Discover before they even reach ranking, and it has reportedly been running for two years already. The system looks at both newer content superseding older pieces and natural relevance decay. If Discover sends you traffic, keeping content genuinely current, not just republished, matters more than previously understood.

Google quietly updates its hyphens in URLs guidance (3 minute read)

Google made a small wording update to its URL structure best practices, still recommending hyphens over underscores to separate words in URLs, for user and search engine clarity. The guidance itself has not changed in substance, so no action is needed beyond noting the page was refreshed.

Google refreshes its page on controlling what you share with Search (3 minute read)

Google updated its help document on controlling what appears in Search to explicitly list existing tools including the robots meta tag, data-nosnippet, X-Robots-Tag and the Search generative AI control. Nothing new was added, Google says it is just keeping the page current. Worth a glance if your team manages what snippets or AI features can use from your pages.

Deep Dives & Analysis

ChatGPT traffic is still tiny next to Google, even with higher conversion rates (9 minute read)

Marie Haynes analysed 12 months of GA4 data across 100 sites with over 145 million sessions and found ChatGPT sessions were just 0.62% of Google organic volume, rising to 0.73% with all LLMs combined. ChatGPT visitors converted at 13.8% versus 3.02% for Google organic, a 4.5x higher rate, but Google still drove 96.5% of total conversions, and Haynes found ChatGPT referral traffic has actually been declining since August 2025. For most SaaS and ecommerce sites, Google organic remains overwhelmingly the traffic and revenue driver, so GEO efforts should not come at the expense of core SEO.

China's GEO industry standard offers lessons after a fake product fooled AI models (13 minute read)

After a Chinese consumer protection broadcast showed a journalist fabricating a product and getting it recommended by AI models using mass-produced fake reviews, China's advertising industry published a five-part standard within six months defining what GEO is, how to measure it, what vendor contracts may promise, and where manipulation begins. Marcus Pentzek argues Western SEO lacks anything comparable and suggests several ideas worth borrowing. If your company buys GEO services, this is a reminder to ask vendors exactly what they are measuring and promising, since no equivalent standard exists yet in Western markets.

Rank tracking tools are breaking down as Google restricts SERP scraping (5 minute read)

Dan Taylor reports that Google has been making aggressive moves this October to stop third parties scraping its search results, causing widespread outages across rank tracking and SEO tools, plus more frequent delays in Search Console data. He argues this accelerates a shift away from keyword position as the primary SEO metric toward brand visibility, AI citations and revenue. If your reporting leans heavily on rank tracking dashboards, expect more gaps and plan to supplement with traffic and conversion data instead.

Search rankings are shifting heavily again, with a core update expected soon (7 minute read)

Barry Schwartz reports unusually high ranking volatility and industry chatter over October 20 and 21, which he believes signals an unconfirmed Google update, on top of widespread expectation that a bigger core update is imminent this month. If your traffic moved sharply this week, check these dates before assuming a site issue, and brace for more changes if the anticipated core update lands soon.

Tactics & Tools

Google spells out what robots.txt can and cannot actually control (9 minute read)

In a new Non-Canonical Cabinet video, Google's Gary Illyes and Chery Prommawin clarify that robots.txt should follow RFC 9309, needs percent-encoding for non-English characters and emojis in paths, and that blocking an AI crawler from crawling is separate from blocking a company from training on content it already has. Have your developer validate robots.txt syntax and test actual URL patterns rather than assuming rules work just because they read clearly to a human.

RankZero's free AI SEO audit (Sponsor)

See whether ChatGPT, Perplexity and Google AI Overviews can find and cite your brand. Free, results in 30 seconds, no signup.

Check whether your bracket URLs are being treated as duplicates (4 minute read)

Google's John Mueller confirmed that raw square brackets in a URL and their percent-encoded form are treated as separate URLs, though Google will usually detect identical content and pick one version. Ask your developer to use one consistent format for brackets, spaces and plus signs across links, canonical tags and sitemaps to avoid leaving the choice to Google.

Quick Links

Emergency PHP patch released for a critical website vulnerability (4 minute read)

PHP shipped emergency fixes (versions 8.5.12, 8.4.27, 8.3.36, 8.2.35) for two critical flaws that let attackers run code on servers without logging in; PHP says patching is the only safe fix. If your site runs on PHP, including WordPress, ask your host today whether the patch is applied, since updating WordPress itself will not fix this.

New JPEG XL image format not yet supported in Google Images or Discover (4 minute read)

Chrome and Firefox now display the JPEG XL image format, but Google's John Mueller says it is not currently supported in Google Images or Discover previews. If your site plans to adopt JPEG XL, keep a supported fallback image format so you don't lose visibility in Images or Discover.

Google specifies exact fast shipping days by country in Merchant Center (3 minute read)

Google updated its Merchant Center documentation with specific delivery-day thresholds for fast shipping badges across Australia, Brazil, Canada, Japan, India, New Zealand, the UK and US (ranging from 1 to 4 days). If you sell products through Google Shopping, check your listed delivery times against these thresholds to keep your fast shipping badge.

A look under the hood of Google and ChatGPT using browser network data (16 minute read)

Mark Williams-Cook describes using Chrome DevTools' Network tab to uncover real Google ranking parameters and ChatGPT's search source sets and freshness windows, including evidence that ChatGPT still reads Reddit heavily even though it rarely cites it. A technical read for anyone on your team curious about what signals these systems actually use behind the scenes.