WordPress.org is adding automated security checks for every plugin release.
During the current 6-hour release cooldown, updates are scanned by several AI models together with Jetpack Scan. If a release gets a high-risk security score, distribution through the WordPress.org update API is automatically blocked until the issue is fixed.
This already stopped a compromised plugin update with around 20,000 active installs from reaching users.
Pretty good move in my opinion, especially considering how much damage a compromised plugin update can cause.
This feature will come also to WPBay in the future, in one form or another.
More details:
https://make.wordpress.org/plugins/2026/09/09/automated-security-review-for-plugin-releases/