In case anyone else comes across this problem in the future, it’s been resolved and it was nothing to do with the wordpress upgrade, and everything to do with my shared host enabling mod_security.
What fixed it for me was disabling mod_security in .htaccess by adding the following lines.
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
It would be better, I think, to disable mod_security for only the files that are affected, in this case I suspect it is ajax_update.php but until I find the time to get into it in more detail I can’t be sure.
