WordPress News Roundup April 2011: Automattic Discloses a Server Break-In as WordPress 3.1.1 and 3.1.2 Ship

April 2011 was dominated by security. On April 13, Matt Mullenweg disclosed that attackers had gained root-level access to several Automattic servers, exposing source code that included some WordPress.com VIP customers’ sites. It was the second serious incident on the hosted platform in six weeks, following March’s denial-of-service attack.

Self-hosted WordPress users were not affected by the break-in, but they had two updates of their own to install. WordPress 3.1.1 fixed almost thirty issues in early April, and WordPress 3.1.2 closed a permissions hole for Contributor-level users at the end of the month.

Mergers, Acquisitions, and Investments

No acquisitions or funding rounds were announced in the WordPress ecosystem in April 2011.

WordPress Core Updates

• WordPress 3.1.1 (April 5): The first maintenance release for 3.1 fixed almost thirty issues. Changes included security hardening for media uploads, performance improvements, better support for IIS6 servers, and fixes for taxonomy and PATHINFO permalinks.
• WordPress 3.1.2 (April 26): A security release for all previous versions that fixed a flaw allowing Contributor-level users to publish posts without the right permission.
• WordPress 3.2 in development: Work continued on the next major version, which was set to raise the minimum requirements to PHP 5.2.4 and MySQL 5.0 and to focus on speed.

Other WordPress News

• Summer WordCamps: On April 16 the official blog encouraged users to attend a WordCamp over the summer, describing the events as informal, locally organised conferences for users, developers and fans.
• VaultPress in the spotlight: Mullenweg shared a customer’s account of what VaultPress, Automattic’s backup and security service for self-hosted sites, meant to them. Backups were very much on people’s minds after the month’s security news.
• WordPress as a publishing platform: Author and investor Tim Ferriss argued in an interview that magazines should use WordPress rather than building their own systems, citing its search engine strengths and the thousands of people already working on it.

Security Alerts and Plugin Vulnerabilities

Two separate stories made April a busy month for security.

• Automattic server break-in (April 13): Mullenweg announced that attackers had gained low-level (root) access to several Automattic servers and that source code, including some VIP customers’ code, may have been exposed. Automattic said it did not believe user information had been accessed but could not rule it out, and WordPress.com users were advised to change their passwords. The company did not say how the attackers got in, only that it had taken steps to prevent a repeat.
• Scope: The incident affected WordPress.com and Automattic’s own infrastructure. Self-hosted sites running the WordPress.org software were not part of the breach.
• WordPress 3.1.2: The Contributor permissions flaw fixed on April 26 was credited to core developer Andrew Nacin and Benjamin Balter. Users were urged to update promptly.
• Upload hardening: WordPress 3.1.1 also tightened security around media uploads, one of the most common ways attackers try to get code onto a server.

Industry Trends and Insights

The Automattic breach showed that large hosted platforms were high-value targets, and that source code stored on servers could include sensitive material such as API keys. It also showed the value of quick, public disclosure, which Automattic provided on the same day.

• Backups as standard: Between the March outage and the April breach, more site owners began treating off-site backups as essential rather than optional, helping services such as VaultPress and BackupBuddy.
• Rising requirements: The coming move to PHP 5.2.4 in WordPress 3.2 put pressure on budget hosts still running PHP 4, pushing the hosting market towards more modern and secure server setups.

Theme of the Month: Genesis Framework

StudioPress’s Genesis Framework had become one of the most popular premium foundations for WordPress sites. Its parent-and-child-theme model, built-in SEO settings and clean code made it a favourite with developers and businesses who wanted a solid base that would survive WordPress updates.

Plugin of the Month: BackupBuddy

iThemes’ BackupBuddy let site owners back up, restore and move an entire WordPress site, including files and database, from the dashboard. In a month when security and recovery were the main topics of conversation, it was a timely choice for anyone without a backup plan.

Host of the Month: Pagely

Pagely, founded by Joshua and Sally Strebel, was one of the first companies to offer managed hosting built only for WordPress. Its focus on security, updates and support was exactly what many site owners were looking for as the risks of running WordPress on generic shared hosting became clearer.

Founder of the Month: Brian Gardner

Brian Gardner founded StudioPress and led the development of the Genesis Framework. His focus on clean design and a strong theme framework helped turn premium themes into a professional product for agencies and businesses, and Genesis’s popularity kept growing through 2011.

Looking Ahead to May 2011

The first beta of WordPress 3.2 was expected soon, about three months after the release of 3.1. Planning for WordCamp San Francisco in August was also moving forward, with a call for speakers still to come.