WordPress News Roundup April 2014: WordPress 3.9 “Smith” Ships as Automattic Buys Longreads and Scroll Kit

April 2014 was one of the busiest months of the year for WordPress. In just over a week the project shipped a security release delivered automatically to millions of sites, a quick fix for a bug that release introduced, and then WordPress 3.9 “Smith”, which modernised the editor and brought live previews to widgets. All of it happened against the backdrop of Heartbleed, one of the most serious internet security bugs in years.

Automattic made two acquisitions in publishing, Jetpack issued a critical security update, and WordPress 4.0 got its release lead.

Mergers, Acquisitions, and Investments

• Automattic acquires Longreads: On April 9 Automattic announced it had acquired Longreads, the service that since 2009 had curated the best long-form writing on the web. Its editorial team joined WordPress.com.
• Automattic acquires Scroll Kit: On April 24 Scroll Kit founders Cody Brown and Kate Ray announced they were joining WordPress.com’s product team. Scroll Kit’s visual page editor, once used to recreate the New York Times’ “Snow Fall” in an hour, would shut down within three months.
• CoSchedule raises $500,000: The editorial calendar plugin CoSchedule raised $500,000 in funding.
• Syed Balkhi’s ThemeLab purchase made public: WPBeginner founder Syed Balkhi revealed that he had bought Leland Fiegel’s theme and tutorial site ThemeLab in a 2013 deal, and DevPress was reported sold for $14,000.

WordPress Core Updates

• WordPress 3.8.2 (April 8): This security release fixed a weakness that could let attackers forge authentication cookies, found by Jon Cave of the security team, and stopped Contributors from improperly publishing posts. It also hardened pingback handling, fixed a low-impact SQL injection and closed a Plupload issue. It was the first security release shipped as an automatic background update, with 3.7.1 sites moved to 3.7.2.
• WordPress 3.8.3 (April 14): 3.8.3 fixed a bug in 3.8.2 that broke the dashboard’s Quick Draft tool, and tried to restore drafts lost in the meantime. The team apologised openly for the lost content.
• Release candidates: 3.9 RC1 arrived on April 8, warning plugin authors about TinyMCE 4 and the switch to MySQLi on PHP 5.5, followed by RC2 on April 15.
• WordPress 3.9 “Smith” (April 16): Named for jazz organist Jimmy Smith, 3.9 brought a faster, more accessible visual editor, clean pasting from word processors, in-editor image scaling, drag-and-drop uploads, gallery previews, audio and video playlists, live widget and header previews in the Customizer and a new theme browser. It was led by Andrew Nacin and Mike Schroder, with 267 contributors.
• WordPress 4.0 kicks off: On April 30 development began on 4.0, with Helen Hou-Sandí as release lead. Dominik Schilling and Sergey Biryukov were given permanent commit access.

Other WordPress News

• BuddyPress 2.0: Released on April 16, BuddyPress 2.0 delivered major performance gains and new admin tools for profiles and signups.
• Developer resources: The new WordPress Code Reference went live on April 25, and redesigned WordPress.org profiles launched earlier in the month.
• Akismet 3.0: Akismet 3.0 shipped with an optional silent-discard feature for the most obvious spam.
• Automattic transparency report: Automattic published a transparency report on government and legal requests and reaffirmed its support for free expression.
• Google Summer of Code: WordPress announced its 2014 GSoC projects on April 21.

Security Alerts and Plugin Vulnerabilities

• Heartbleed: The OpenSSL “Heartbleed” bug, disclosed on April 7, affected a large share of HTTPS servers. It was not a WordPress flaw, but hosts patched servers and site owners were urged to change passwords.
• Jetpack 2.9.3: On April 10 Jetpack released a critical update for a bug, present since version 1.9, that could let attackers bypass access controls and publish posts. Sites left on old versions were warned they could be disconnected from the Jetpack service.
• SyntaxHighlighter Evolved: An important security update was released for the SyntaxHighlighter Evolved plugin at the end of the month.

Industry Trends and Insights

• Automatic updates prove themselves: 3.8.2 showed background updates could deliver a critical patch fast, and 3.8.3 showed the same system could fix a mistake just as quickly.
• Automattic bets on long-form: Longreads and Scroll Kit pointed to an interest in high-quality publishing and visual storytelling on WordPress.com.
• Themes shed features: Developers increasingly moved functionality out of themes and into plugins to avoid lock-in.

Theme of the Month: Underscores

Underscores (_s), Automattic’s starter theme, received fresh attention this month through a detailed introduction by contributor Konstantin Obenland. As the base for countless themes on WordPress.com and WordPress.org, it was shaping a generation of cleaner, more standard theme code.

Plugin of the Month: Akismet

Akismet 3.0 was a substantial update to the anti-spam plugin bundled with WordPress, adding the option to discard the most blatant spam silently. For many sites it meant spending far less time reviewing the spam queue.

Founder of the Month: Syed Balkhi

Syed Balkhi, founder of WPBeginner, made public this month that ThemeLab, bought in 2013, had joined his growing group of WordPress properties. His strategy of buying and building educational sites and products would make him one of the ecosystem’s most active entrepreneurs.

Looking Ahead to May 2014

A 3.9.1 maintenance release is likely in May as 4.0 development gets going. WordCamp Miami takes place in early May, the JSON REST API team is close to version 1.0, and WordPress turns 11 on May 27.