WordPress News Roundup April 2013: A Massive Brute-Force Botnet Hits WordPress as 3.6 Enters Beta

April 2013 was the month WordPress security made mainstream headlines. A distributed brute-force campaign hammered WordPress login pages across major hosts, and two of the most popular caching plugins turned out to allow remote code execution. In between, WordPress 3.6 finally reached beta, the project announced plans for its 10th birthday, and a former WordPress UI contributor raised a small fortune on Kickstarter for a rival blogging platform.

Mergers, Acquisitions, and Investments

No notable acquisitions were announced this month. The closest thing to a funding story was Ghost’s crowdfunding campaign, covered below.

WordPress Core Updates

• WordPress 3.6 Beta 1 (April 4): Beta 1 arrived after nearly three months of work with all slated features complete: a dedicated Post Formats UI, the Twenty Thirteen theme, a rebuilt revisions screen, autosave and post locking, and native audio and video support. The leads stressed it was a real beta, not an alpha with a new name.
• WordPress 3.6 Beta 2 (April 29): The longer-than-usual gap before Beta 2 was due to poor user-testing results for the Post Formats UI. The new beta changed how formats were chosen and switched, made the UI hideable through Screen Options, and noted more than 150 contributors to 3.6 so far.
• Post formats philosophy: A make/core post on April 23 laid out the thinking behind post formats and the release schedule, as debate grew over whether the UI was ready.
• Audio and video in core: On April 8 the team detailed the new audio and video support, built on the MediaElement.js player, so sites could embed media without third-party services.
• New committer: The core team congratulated Dominik Schilling (ocean90) on joining the ranks of committers on April 11.

Other WordPress News

• Save the date: May 27: The project asked fans to throw parties for WordPress’s 10th anniversary on May 27, coordinated through Meetup Everywhere and the #wp10 hashtag, and put 10th anniversary T-shirts on sale at cost for $10.
• Summer mentorship: WordPress joined both Google Summer of Code and the GNOME Outreach Program for Women, with almost 30 mentors lined up and an explicit goal of bringing more women into contribution.
• Twenty Thirteen on WordPress.com: Twenty Thirteen went live for WordPress.com users ahead of its self-hosted debut in 3.6.
• Ghost on Kickstarter: On April 29 John O’Nolan launched a Kickstarter for Ghost, a Node.js blogging platform focused purely on writing. It hit its £25,000 goal within hours.
• Community moves: Daniel Bachhuber joined UK agency Human Made, Elegant Themes marked five years in business, and Gravity Forms 1.7 overhauled notifications and confirmations.

Security Alerts and Plugin Vulnerabilities

• The brute-force botnet: Around April 11, HostGator and CloudFlare reported a large, distributed campaign trying to log into WordPress sites with the username “admin” and lists of common passwords. HostGator said more than 90,000 IP addresses were involved, and US-CERT issued an alert on April 15. Matt Mullenweg urged site owners to stop using “admin” as a username and to pick strong passwords, and hosts rushed out rate limiting and firewall rules.
• W3 Total Cache and WP Super Cache: On April 24, Sucuri publicised a remote code execution flaw in both caching plugins: PHP placed inside “mfunc” dynamic-caching tags in a comment could be executed on the server. W3 Total Cache 0.9.2.9 and an updated WP Super Cache fixed the issue, and users were told to update immediately.

Industry Trends and Insights

• Popularity makes WordPress a target: The botnet was not exploiting a WordPress bug. It was exploiting weak passwords at scale, and that is only worthwhile against the web’s most popular CMS.
• Appetite for simpler blogging: Ghost’s overnight success showed real demand for a focused writing tool, and it became a reference point in WordPress’s own discussions about the editor and post formats.
• Hosts as security providers: The attack pushed hosting companies to treat login protection as part of the service, a shift that fed directly into new products later in the year.

Theme of the Month: Twenty Thirteen

With its WordPress.com launch and its arrival in 3.6 Beta 1, Twenty Thirteen moved from mock-up to something people could actually use. Its colourful, format-led design was the showcase for everything 3.6 was trying to do for bloggers.

Plugin of the Month: Limit Login Attempts

During the botnet attack, the long-standing Limit Login Attempts plugin was one of the simplest defences available to site owners: it blocked an IP address after repeated failed logins. Its sudden relevance showed how basic login hardening had become essential for every WordPress site.

Host of the Month: HostGator

HostGator was among the first hosts to sound the alarm about the brute-force campaign, publishing what it was seeing and telling customers to change weak passwords. Its public warning helped turn a hosting problem into a coordinated response across the industry.

Founder of the Month: John O’Nolan

John O’Nolan, who had previously worked on WordPress’s user interface, turned a concept for a writing-first blogging platform into one of Kickstarter’s fastest-funded software projects. Ghost’s launch forced a healthy conversation in the WordPress world about simplicity and focus.

Looking Ahead to May 2013

May 27 is WordPress’s 10th birthday, with parties planned around the world. More 3.6 betas are due, and the fate of the Post Formats UI is the big open question. Google Summer of Code students and Outreach Program for Women interns will be announced, and the Ghost campaign continues through the month.