SEO Recap covering October 21, 2026: SERP tracking blackouts, PHP2Shell patch, and Discover's SDF filter

Built by Stephanie Chung·9 min read·11 stories

Daily summary of what matters in SEO, GEO, AEO, and AI search generated with Claude Code (beware of hallucinations)

Generative Engine Optimization (GEO) & Answer Engine Optimization (AEO)

China Wrote the First GEO Rulebook After a TV Scandal
Source: Search Engine Journal

  • After a March 2026 CCTV 3·15 broadcast exposed vendors who placed a fictional smart wristband into AI recommendations (dubbed "AI poisoning"), the China Association of Commercial Advertising issued a 5-part GEO standard within 6 months. Publicis Group is listed as a drafter of Parts 1 and 5.
  • The standard requires a minimum of 30 runs per measurement to handle generative answer variance, and defines core metrics: AI visibility rate, share of visibility, average position, sentiment non-negative rate, and source citation rate. Visibility rate is calculated only on category questions, never branded ones.
    • AI visibility rate (share of answers mentioning the brand, top-1 or top-3)
    • Share of visibility versus competitors
    • Average position where the brand first appears
    • Sentiment non-negative rate
    • Source citation rate
  • Contracts must include a formal appendix of non-promisable items (banning claims like "absolute control of model output" or "100% screen dominance") and a clause prohibiting black-hat GEO. In hybrid pricing, the fixed portion for legitimate work should be at least 30% of contract value to reduce incentives to fabricate content.
  • Black-hat GEO is defined by specific tactics (fake content, corpus poisoning, prompt injection, fake traffic and reviews, forged sources), while legitimate advertising, PR, media placements, and influencer work are explicitly carved out as long as content is truthful. An error-correction mechanism requires starting fixes within 72 hours.

AI in Search / AI Overviews

Rank Tracking Broke in September. Measure Brand Visibility Instead
Source: Search Engine Journal

  • Aggressive Google moves against SERP scraping in October triggered simultaneous outages across dozens of third-party SEO tools and delays in Search Console data processing, hitting tens of thousands of agencies and internal teams.
  • Single keyword rank positions no longer describe the modern SERP, since AI query fanout and grounding queries run behind the scenes and never produce a human-visible result.
  • Measure success through 2 areas instead: serving (breadth of brand visibility across all surfaces including AI features) and citing (direct brand or URL citations inside AI answers).
  • Pick one AI visibility tool and stay in it, expect fluctuation rather than linear growth due to citation drift and personalization, and split prompts into core, experimental, edge, and drift-measuring stacks.

Technical SEO

Reverse Engineering Google and ChatGPT Through Chrome Network Data
Source: Search Engine Journal

  • Chrome DevTools Network tab (F12, filter to Fetch/XHR) exposes backend parameters and values most SEOs never inspect, including Google's site_quality_score and rq_semantic_class.
  • Deleting an _fmt=prog parameter on a Google async callback URL returned structured data (site quality scores, inverse document frequency, last significant update time, server IP), earning a $13,337 Google bug bounty.
  • Google classifies queries into 8 refined-query semantic classes. Mark Williams-Cook fine-tuned DistilBERT on 4.8 million labeled English queries over ~50 hours to build the free QueryClassifier.com, which predicts query class and likely SERP features.
  • ChatGPT fan-out queries once surfaced via search_model_queries in the Response, and network data showed Reddit is still read by ChatGPT as much as ever even though it is rarely cited now.

Emergency PHP Patch (PHP2Shell) and How to Take Sites Offline Safely
Sources: Search Engine Journal · Search Engine Roundtable

  • The PHP team shipped emergency fixes on October 21, 2026 for 2 critical unauthenticated remote code execution flaws, dubbed PHP2Shell, affecting roughly 70% of websites. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • Researchers found the flaws using AI models, and an attack tool was reported circulating before the patch. Apache servers using mod_php face the highest risk, with attacks able to run before a site's own code starts.
  • Updating WordPress or plugins does not update PHP. Ask your host to install a fixed version, and note PHP 8.1 and older are end-of-life with only limited source fixes provided.
  • If you take a site down to patch, Mueller recommends serving an HTTP 503 (not timeouts, 404, or 500), which you can do outside PHP via DNS or a CDN to avoid ranking and indexing damage.
  • After patching, check for web shells, unfamiliar admin accounts, and unexpected PHP file changes, since a patch does not remove an existing compromise.

Google Images and Discover Previews Don't Support JPEG XL
Source: Search Engine Journal

  • John Mueller said on Bluesky (Oct. 15) that JPEG XL (.jxl) is not currently supported in Google Images or as Discover previews, even though Chrome 155 (widely rolled out Oct. 6) and Firefox 158 (Oct. 13) now display the format.
  • Google's image SEO page lists 7 supported formats in the img src attribute: BMP, GIF, JPEG, PNG, WebP, SVG, and AVIF. The page was last updated March 2 with no JPEG XL changelog entry as of Oct. 20.
  • Serve JPEG XL via a picture element with a supported fallback (JPEG, WebP, or AVIF) in the img src, and make sure og:image and schema.org image links use a listed format so Discover can pull a thumbnail.
  • For reference on timelines, AVIF reached Search roughly 4 years after arriving in Chrome, and Google gives no timeline for JPEG XL.

Google Treats Raw and Encoded Bracket URLs as Different URLs
Source: Search Engine Journal

  • Mueller said raw square brackets and their percent-encoded versions (%5B and %5D) are different URLs, citing RFC 3986 Section 2.2 where swapping a reserved character for its encoded form is not equivalent. He admitted he likely gave wrong answers on this before.
  • Google crawls both versions and, if the content is identical (even at checksum level), de-dupes and picks one. The same duplicate rules apply to spaces, plus signs, and %20.
  • Raw brackets in a query string are technically invalid under RFC 3986, which reserves brackets for wrapping IPv6 addresses in the hostname. Encoding case does not matter, so %5B and %5b are equivalent.
  • Choose one format across all links, canonical tags, sitemaps, and structured data. Google's documentation already requires encoding reserved characters, and some non-Google crawlers may not handle brackets as precisely.

Google's Second Non-Canonical Cabinet Video Covers robots.txt
Source: Search Engine Roundtable

  • Gary Illyes and Cherry Prommawin's new video covers what robots.txt supports, stressing files should follow the RFC 9309 standard and that Googlebot only reads user-agent, allow, disallow, and sitemap directives.
  • Use percent-encoding for emojis and non-English characters in rule paths, since encoding inconsistencies can cause older or other crawlers to ignore a disallow line entirely.
  • Separate crawling controls from AI training policies. Blocking an AI crawler from accessing a page is different from telling a company not to train on content it already obtained, and AI crawler rules must name the correct user-agent token.
  • Robots.txt is an access-preference protocol, not a security mechanism. Malformed lines are silently discarded, so validate syntax and test actual URL patterns rather than assuming a human-readable rule works.

Google Updates "Control What You Share" Documentation
Source: Search Engine Roundtable

  • Google refreshed its "Control what you share with Google Search" help page to include existing options: robots meta tag, data-nosnippet, X-Robots-Tag, and the Search generative AI control.
    • robots meta tag, data-nosnippet, or X-Robots-Tag
    • the Search generative AI control
  • 2 new sections were added covering those controls, along with minor clarifications that the page applies to Google Search. Google also updated its URL structure best practices document the same morning.

Google Tweaks URL Hyphens Documentation
Source: Search Engine Roundtable

  • Google revised the "Use hyphens to separate words" section of its URL structure best practices, keeping the same recommendation to use hyphens over underscores but rewording the explanation.
  • The update clarifies that hyphens clearly signal a word boundary while underscores are commonly used in programming to keep concepts together (such as format_date). The change followed Google's new URL video series.

Google Discover's SDF Freshness Algorithm Revealed
Source: Search Engine Journal

  • Google published research on Supersession-Decay Filtering (SDF), a staleness filter already running in Discover for 2 years and serving hundreds of millions of daily users.
  • SDF uses 2 AI filters: supersession, which detects when newer content has replaced older content, and relevance decay, which predicts when content loses usefulness even without a replacement. If either flags content as stale, it becomes ineligible for ranking.
  • Over 2 years of deployment, user complaints about stale content fell 54.9%, with modest engagement and content diversity gains plus reduced computing costs by pruning before the ranking stage.
  • Publication dates and engagement metrics are deemed unreliable (dates don't signal relevance, engagement is reactive). Plan content mix across evergreen, limited-window, and news, and factor freshness into interlinking decisions since SDF adds a freshness dimension to semantic relevance.

Organic Search & Algorithm Updates

Unconfirmed Ranking Volatility Spikes Ahead of Expected Core Update
Source: Search Engine Roundtable

  • Google rankings turned highly volatile over 24 hours with heavy SEO chatter, pointing to an unconfirmed update as the industry awaits a core update expected later in the month.
  • The September 2026 spam update ran September 24 to October 8 in 3 volatility waves, and this follows another unconfirmed update flagged October 16.
  • Publishers report wild Discover and Search traffic swings, including traffic that surges for an hour or 2 then dies, suggesting a changed Discover shelf life.
  • Glenn Gabe confirmed 2 YMYL-niche sites fully dropped from SERPs (even for brand queries) then surged back on Oct. 16 at 8:15 pm, echoing September glitches, and noted tracking tools are missing the full picture with wrong dates.
Published on
geoai searchtechnical seoorganic searchdigest