GEO Doubts, Agentic Search and a PHP Emergency: Oct 19 to 23, 2026

Today's traffic and tomorrow's interface pulled in opposite directions

Last week the measurement tools broke, as we covered in our October 12 to 16 roundup. This week the industry used the data it still trusts to argue about where to spend. Three studies said AI referrals are small. Google's CEO said the search box is turning into an agent. A vendor study said AI Overviews now sit on nearly every commercial query.

You do not have to pick a side. The numbers describe where clicks come from today, and the product roadmap describes where answers will come from next year. The sections below take each in turn, then cover the crawl-rights fights, the PHP emergency and the ChatGPT ads changes that need action before month end.

ChatGPT still sends a sliver of Google's traffic

The headline figure comes from Marie Haynes, an SEO consultant, who looked at 12 months of GA4 data across 100 websites and more than 145 million sessions. Search Engine Land reported that ChatGPT referred about 0.62% as many sessions as Google organic search. Adding every other LLM only lifted that to 0.73%, measured against Google organic, not total traffic.

Conversion data, drawn from 55 of the sites, told a more mixed story. ChatGPT visitors converted at 13.8% versus 3.02% for Google organic. Google organic still drove 27 times as many conversions as all LLMs combined. Haynes also reported that ChatGPT referral growth stopped compounding in August 2025 and declined after that. She called GEO "a distraction."

Two more studies landed in the same week, and Search Engine Roundtable grouped all three. UK agency SEO Works found organic search delivered 39 times more traffic than AI assistants, and for every 100 organic conversions, AI referrals delivered 3.2. Consultant Kevin Indig studied 12 sites and could not find a reliable link between AI visibility and branded search or direct traffic, though he said brands with strong AI growth might see one.

All three authors sell SEO or GEO services, so each has a stake in how the result is read. Search Engine Land also flagged the gaps in Haynes' analysis.

Why it matters. If someone in your company is using these numbers to move budget, the honest reading is narrower than the headline. Google organic is still where most measurable revenue starts, so the basics have to stay funded, a point we make in our guide to the SEO build order for AI search. The data does not show that AI answers have no effect. It shows they rarely send a click, and that is a different claim.

Sundar Pichai says the future is one agentic box

On the other side of the ledger, Google's CEO gave an interview to Alex Heath on the Sources podcast. Search Engine Journal reported that Pichai described an "agentic layer" that unifies Search and Gemini rather than merging the two products.

"Our vision in the near future is it's one box."

He said users increasingly type task-focused queries, that Google is bringing agent capabilities to Search "in a pretty deep way," and that Gemini's agent features, now mostly for Ultra and Pro subscribers, will become more widely available over the next few months.

In a second write-up of the same interview, Pichai said agents will reach websites two ways: by browsing pages the way a person does, and through purpose-built protocols such as MCP and Google's own Universal Commerce Protocol. He expects "a chaotic evolution" before standards settle. Asked how ads fit when an agent does the browsing, he said the long-term answer is to put users first, which is not an answer about ads.

Google already documents how its hosted agents fetch pages. Its user-triggered fetchers page says these fetchers generally ignore robots.txt because a person asked for the fetch.

Why it matters. Put this next to the Haynes data and the picture is clear. Click referrals from AI are small now, and Google is building a product where fewer of its own answers end in a click at all. The work that holds value in both worlds is the same: pages an agent can parse and act on, product data that feeds commerce protocols, and brand signals strong enough that an agent picks you. Measure today's traffic, and prepare for a funnel you will see less of.

AI Overviews now sit on most commercial queries

A Semrush study reported by PPC Land tracked 400 US commercial keywords in banking, software and ecommerce, checked monthly from September 2025 to August 2026 on desktop. AI Overview coverage rose from 45.75% to 88% of keywords. Weighted by Semrush's search volume estimates, coverage reached 97.08%.

Ecommerce terms rose from 32.62% to 85.11%. "Best X for Y" queries reached 96.12% by August. Semrush, now part of Adobe, sells the visibility tracking its recommendations call for, and PPC Land made the same point.

Why it matters. Review, comparison and "best for" pages are the bottom of most B2B and ecommerce funnels, and they are now the queries most likely to be answered before the organic results. That does not make those pages worthless. It makes them source material. The page that gets cited inside the Overview is the one with specific, current, checkable claims.

Robots.txt cannot say no to training

Google's Gary Illyes used the second episode of the Non-Canonical Cabinet video series to draw a line many site owners blur. Search Engine Journal quoted him:

"So as defined by RFC 9309, robots.txt is an access preference protocol."

The file, defined in RFC 9309, "doesn't dictate what a system does with the data after it has already crawled it." To keep one AI crawler out, you have to target its user agent token by name. Invented rule names get ignored.

Meta tested that gap the same week. Search Engine Journal reported on October 19 that Meta removed "train" from the crawl clause of its new Commercial Terms, which take effect October 30, while keeping permission to crawl sites associated with a business's products or services. The terms apply to any business using Meta's products, including companies that run a Facebook Page without buying ads. Cornell's James Grimmelmann told Nieman Lab the purposes language is "still broad enough to drive a truck through."

Google, for its part, refreshed its control what you share with Google Search page on October 21. Its documentation changelog says it now gathers existing options, including the robots meta tag, data-nosnippet, X-Robots-Tag and the Search generative AI control. Nothing new, just in one place.

Why it matters. Most sites hold one lever, crawl access, and it works one bot at a time. If your policy is to allow search crawlers and block training crawlers, check each token, then check the terms your team accepts on ad and social platforms. A contract you clicked through can grant what your robots file declines.

The PHP emergency and the 503 rule

On October 21 the PHP project published a critical advisory: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities that can allow unauthenticated remote code execution, tracked as CVE-2026-109618 and CVE-2026-109619. The project's pre-release notice rated both CVSS v4.0 9.2 and urged all users to update immediately. PHP 8.1 and older no longer receive updates from the project.

Some site owners took sites down while they patched. Search Engine Roundtable reported that Reuters found government, school and hospital sites in Europe offline on Wednesday, and that Google's John Mueller posted advice on Bluesky.

"use HTTP 503 instead of letting responses time out / 404 / 500."

Mueller added that the 503 can be served outside PHP, through DNS or a CDN. Google's guide to temporarily pausing a website covers the longer version.

Why it matters. WordPress and most CMS stacks run on PHP, so this one reaches marketing sites directly. Most sites can patch without downtime. If yours cannot, a short 503 tells Google to come back later, while a 404 or a timeout invites it to drop pages. Confirm the patch with your host in writing, then check Search Console crawl stats next week.

ChatGPT Ads explains its auction and starts rewriting your copy

OpenAI published a technical breakdown of how ChatGPT chooses ads, which Search Engine Journal summarized. According to OpenAI's post, a separate "orchestrator" model reads the conversation, turns it into search queries, and finds and vets candidate ads, while a separate auction sets ranking and price. A post-auction relevance check can still block a winner that does not fit. Search Engine Journal's write-up cites a $1 billion annualized run rate reached in under 200 days, a projection rather than collected revenue, and more than 100,000 advertisers since launch. OpenAI did not say how much weight each signal gets.

Then came the email. Search Engine Roundtable reported that OpenAI is turning on creative enhancements for new and existing self-serve campaigns on October 30. Per OpenAI's help article and the email, the system can write new headlines and descriptions, translate text, resize images and point links at a different page on your site.

"When enabled, these ads can run automatically without requiring you to review or approve each version."

Why it matters. The separation of ads from answers is OpenAI's description of its own system, and Search Engine Journal said as much. The creative change is concrete and has a date. If you run regulated, legal or brand-sensitive ads, decide before October 30 whether to opt out at account or campaign level, since campaign settings override account defaults.

Rankings churned again, with no update to point at

Search Engine Roundtable tracked a spike in ranking volatility and forum chatter on October 20 and 21, with most third-party tools showing movement and Google confirming nothing. Glenn Gabe reported sites that dropped out and came back days later.

Treat any single tool with care. A Search Engine Journal survey of rank tracking vendors found Nozzle, which first flagged the problem, counted 8.7% of its first pages as poisoned between September 13 and October 21, against 0.17% from August 20 to September 9. Ahrefs estimated 5% to 20% of results were affected depending on the provider, and AccuRanker described re-fetching pages that do not match recent history. These are vendors describing their own fixes, and none cited independent testing.

Why it matters. A drop in your tracker this week may be real, a Google bug, or bad data. Confirm it in Search Console before you react.

Also this week

• On October 21, Postmedia, Torstar, The Globe and Mail and The Canadian Press sued Anthropic for copyright infringement over Claude's training, according to Press Gazette's tracker.
• Some AI Overviews on desktop showed up without their label starting October 20, and Search Engine Roundtable saw the label back on October 22.
• John Mueller said raw square brackets and their encoded forms are different URLs that Google crawls separately, and advised encoding them, as Search Engine Journal reported.
• Google lightly reworded its guidance on hyphens versus underscores in URLs, which Search Engine Roundtable spotted on October 21. The advice did not change.
• Mueller said JPEG XL is not supported for Google Images or Discover previews, so keep a supported fallback, per Search Engine Journal.
• Google is testing Google Business Home, a Gemini-powered beta hub for Business Profile, Merchant Center, YouTube and Ads, with select US and UK categories, Search Engine Roundtable reported.

What we would do first

The GEO debate is being framed as a choice between Google and AI, and that is the wrong frame. Google is the AI surface that sends traffic today, and it is turning itself into the agent. The brands that keep winning are the ones whose pages, data and reputation hold up whichever box the question lands in.