Google dominates our SEO news again this month, and recent studies show it is still by far the main source of traffic and conversions for websites. Reflecting on three studies released in October 2026, Rand Fishkin wondered whether chasing AI visibility had been a waste of time and suggested site owners should go back to putting effort into getting traffic from Google. One of the studies he reviewed is “GEO is a distraction” by SEO Marie Haynes. Across 100 sites tracked in GA4 over 12 months, she found that LLMs (including ChatGPT, Gemini, Perplexity, Claude and Copilot) generate just 0.73% of the organic traffic Google sends. Traffic from ChatGPT converts better (13.8% for ChatGPT compared to 3.02% for Google), but Google still drives 27 times more conversions. She also found that traffic from ChatGPT to these sites peaked in October 2025 (105,371 visits per month) and has dropped by about a third since (71,018 in September 2026). You can check your AI search traffic and conversions in Google Analytics.
Our take is that although Google remains the most important source of traffic for websites, new opportunities exist in search tools like ChatGPT and, increasingly, AI agents. These may not result in visits by humans to your website but can still generate business. With AI Overviews and AI Mode, Google is also a generative engine, so GEO (optimizing a website for generative engines) is not really a distraction. A new name for SEO is not useful if it suggests that SEO is no longer relevant. It very much is: getting a website indexed and ranked by search engines for keywords is the first step to being cited by AI.
End of the Google September 2026 Spam Update
The September 2026 Spam Update, featured in last month’s news, finished rolling out on October 8th, two weeks after its launch on September 24th. In his weekly video of October 9th, Barry Schwartz says there was still volatility after the update had finished. He also noted increased reports of Google issuing manual actions, notably for thin and scaled content.
Now that the update is over, you should check your rank tracking software (like SEOPress Insights) to make sure that you have not been affected by this update. Signs that you were hit by the Spam Update would be a drop in ranking between September 24th and October 8th with no recovery to date. See our guide on recovering from a Google update. If you have received a manual action from Google in October, we have a guide for dealing with that too.
Be aware however that some rank tracking tools were having problems tracking Google correctly during the Spam Update. On October 27th, Semrush said that it had seen poisoned SERPs in Google, as reported by Search Engine Roundtable earlier in the month. Google has not commented.
PHP2Shell vulnerabilities, WordPress and SEO
News leaked on October 20th concerning PHP2Shell, two vulnerabilities in the PHP programming language used by WordPress and many other applications on the web, before the fixes were released. The next day, WordPress advised website owners to immediately update PHP on their servers. WordPress referred to a PHP.net news bulletin indicating that the releases fixing the vulnerabilities are PHP 8.5.12 for the PHP 8.5 branch, 8.4.27 for 8.4, 8.3.36 for 8.3 and 8.2.35 for 8.2. It also indicated that some web hosts may already be working to update PHP and put web application firewall (WAF) rules in place.
To check if your server is running a secure version of PHP, log into WordPress and navigate to Tools > Site Health from the menu. On the Site Health page, click on the Info tab and then click on Server to see information about your server setup (see the screenshot below).
Next to PHP version, you want to see a version equal to or greater than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on which branch of PHP you use. PHP versions before 8.2 (over 4 years old) are not officially supported. If your server version is not up to date, contact your hosting provider – or check emails they may have sent you, as they may have already applied a patch. If you are in doubt, reach out to your web hosting support team.
Google’s John Mueller posted advice on Bluesky for sites that need to shut down temporarily to update PHP. He said they should make sure they use HTTP 503 codes rather than let Googlebot hit timeouts or 404 or 500 errors. He pointed to existing documentation Temporarily pause or disable a website and How to deal with planned site downtime on Google Search Central for detailed instructions.
Also see our guide on recovering from a hacked website.
Intelligent search results in ChatGPT and Google
OpenAI started rolling out the GPT-6 model to all ChatGPT users on October 7th (Plus, Pro, Business and Enterprise plans that day, Free and Go plans the next day). One of the new features in this release is “Intelligent UI”, a capability that generates interactive user interfaces in response to questions. This may include visuals, questionnaires or interactive tools. The release announcement shows some examples in video and with side-by-side comparisons with GPT-5.6.
Google’s “Generative UI” does something similar. It is visible as Dynamic View in the Gemini app and can be seen in AI Mode on Google Search. Both developments suggest that we should expect search engine results to become increasingly interactive rather than be static AI-generated text or lists of links. In October, Google also announced clearer links in AI-generated responses in AI Mode and AI Overviews, some of which are still being tested. Google has not shared data on how these links affect traffic to sites.
New video resources from Google Search Relations
The Google Search Relations team has been very busy in October! As well as attending physical events in Barcelona, Mexico City, Bogota, Bangalore and Gurugram, team members have also released a lot of new content (mainly on YouTube).
Non Canonical Cabinet
Gary Illyes and Cherry Prommawin from the Google Search Relations team host a new video series called the “Non Canonical Cabinet” where they go through technical SEO questions from website owners that don’t quite fit the standard documentation.
Subjects covered so far are:
- What can you actually put in a URL?
- What can you actually put in a robots.txt? (Gary’s favorite topic)
- Halloween special: should we be scared of a 404 status code?
The tone is very humorous. Check out the trailer to see if it is your type of humor and, more importantly, if it helps you understand technical SEO topics.
Google Search News October 2026 with John Mueller
Continuing the Google Search News video series, John Mueller presents again in the October 2026 edition. He goes through a lot of recent news including new Google Search Console features, Core and Spam Updates, favicons, Preferred sources and Google Search Profiles (now available in Canada and India).
He also shares content from the search community:
- Ankitt Prajapati’s Monday routine in Google Search Console
- Dayna Lucio’s Multi-Location SEO Data
- Jen Cornwell’s Creator Content in AI Search
- Mark Williams-Cook’s CATS.TXT Analysis
More Search Off the Record podcasts
Search Off the Record podcasts recorded by the Google Search Relations team are available on YouTube and other podcast platforms. After a hiatus of two months, John Mueller and Martin Splitt published two new episodes in October.
These 30-minute episodes can be a long listen but often give interesting insights into how Google search works. If you just want the insights, check out a tool provided by SEO John McAlpin. He’s logged every SEO-relevant claim on Search Off the Record since the start of the podcast series.
For example, some of the insights he noted from the last two episodes were:
- Yes, sitemaps matter for most sites
- Each sitemap is limited to 50,000 URLs and sitemap index files can only be nested one level deep
- Sitemaps still support image and video extensions (alongside hreflang annotations) but Google has become better at detecting images and videos on pages without a sitemap
- Google converts PDFs into HTML during indexing, so the rest of the pipeline treats them like web pages
- Links inside PDFs are preserved and followed after Google converts the file to HTML
- Rasterized PDF pages (document converted to image) hide all text from Google; test if your PDF is rasterized by copying text out of the PDF
- Google recrawls PDFs infrequently, so it can make sense to use a new file name when you update one
- Sites generally don’t need to offer “save as PDF” versions of their pages
- A PDF restaurant menu beats no menu at all, but an HTML menu is better.
New SEO learning paths on YouTube
As detailed in the article New learning paths: curated YouTube playlists for Search fundamentals and Technical SEO, Google’s Daniel Waisberg published new playlists (not new videos: some are several years old) to create learning resources for:
The Convincing Machine by Martin Splitt
On a more personal note, Google developer relations engineer Martin Splitt published his thoughts about AI on his blog That’s a Website in October. He argues that AI is not a thinking or truth-seeking entity. He says AI output is designed to convince people they have received a good answer, even when it is inaccurate.
This ties in with Google Search’s guidance on using generative AI content on your website. It was updated on October 1st with this new text: “Keep in mind that generative models don’t retrieve facts, but predict a likely sequence of words based on their training data. Because of this, generative AI outputs may contain inaccuracies (also known as hallucinations). It is critical to manually factcheck and review all AI-generated content for accuracy and trustworthiness before publishing.” This means that to succeed in SEO you (still) need to prove you are a reliable source and provide useful, unique content.
