WordPress News Roundup August 2014: Automattic Acquires BruteProtect and WordPress 3.9.2 Fixes an XML Flaw With Drupal

August 2014 brought an unusual collaboration and a significant acquisition. WordPress and Drupal shipped coordinated security releases for the first time to fix a shared XML processing flaw, and Automattic bought the company behind BruteProtect to fold its login protection into Jetpack. WordPress 4.0 moved through its final beta to a release candidate, picking up plugin icons along the way.

It was also the month Google retired a feature many WordPress SEO plugins had been built around, and PHP shipped a new version that WordPress hosts would take years to adopt widely.

Mergers, Acquisitions, and Investments

• Automattic acquires Parka (BruteProtect): On August 26 Automattic announced it had acquired Parka LLC, maker of BruteProtect, for an undisclosed sum. All seven Parka employees joined the Jetpack team, BruteProtect’s paid features became free, and the service was to be rolled into Jetpack.
• WP Site Care acquires Audit WP: Maintenance company WP Site Care bought Audit WP, the site-auditing service that had earlier publicised SEO concerns about some managed hosts.
• Agency appointments: Crowd Favorite named Chris Lema as CTO, and WebDevStudios appointed Dre Armeda as vice president of operations.

WordPress Core Updates

• WordPress 3.9.2 (August 6): This security release fixed a possible denial-of-service issue in PHP’s XML processing, reported by Nir Goldshlager of Salesforce’s product security team. It was fixed by Michael Adams and Andrew Nacin with David Rothstein of the Drupal security team, the first time the two projects had coordinated security releases. It also addressed unlikely code execution when processing widgets, XML entity attacks in the GetID3 library and brute-force attacks on CSRF tokens. Older branches were updated to 3.8.4 and 3.7.4.
• 4.0 Beta 3 and Beta 4: Beta 3 shipped alongside 3.9.2 with the same fixes, and Beta 4 followed on August 15 with more than 250 changes in a month, including editor scrolling refinements, a bulk selection mode for the media grid and a better installation language selector.
• Plugin icons: WordPress.org introduced icons for plugins, shown in the 4.0 plugin installer alongside banners.
• 4.0 RC1 (August 27): The first release candidate arrived with the final release planned for the following week, and plugin authors were asked to update their “Tested up to” values.

Other WordPress News

• WordCamp NYC: WordCamp NYC took place on August 2–3, and Helen Hou-Sandí previewed WordPress 4.0 at a New York meetup later in the month.
• Akismet and VaultPress upgrades: Akismet’s account dashboard was overhauled, and VaultPress said restores were now 25% to 90% faster.
• WordPress.com VIP training: WordPress.com VIP released a free WordPress “superuser” training course.
• Matt on Facebook: Matt Mullenweg hosted an impromptu Q&A session on Facebook.
• Underscores adds Sass: The Underscores starter theme added optional Sass support.
• Multilingual content: A Post Language project proposed better core support for multilingual content.
• WP Tech leaves the WordCamp program: The organisers of WP Tech announced that their event would no longer run under the WordCamp name.
• PodsCamp: Tickets went on sale for the first PodsCamp, dedicated to the Pods framework.
• Sprout Apps: Sprout Apps announced a suite of WordPress-powered tools for freelancers and small businesses, starting with invoicing.
• Trademark advice: Gravity Forms co-founder Carl Hancock shared advice on registering trademarks for WordPress businesses.
• ProWordPress grows: The ProWordPress subreddit for advanced developers passed 1,000 subscribers.

Security Alerts and Plugin Vulnerabilities

• WordPress 3.9.2 and Drupal: The XML denial-of-service flaw affected both platforms because they relied on the same PHP XML processing, so the joint release protected a large share of the web at once.
• All In One WP Security and Firewall: A serious bug was discovered in this security plugin in early August, and users were urged to update.
• BruteProtect becomes free: With the Automattic acquisition, BruteProtect’s professional login protection was made free for all users.

Industry Trends and Insights

• Google Authorship ends: Google ended its Authorship program at the end of August, making a whole category of authorship plugins obsolete.
• PHP 5.6 released: PHP 5.6 was released on August 28, while WordPress continued to support versions back to 5.2.4.
• Open-source cooperation: The coordinated WordPress and Drupal release showed rival CMS projects working together on shared security problems.

Plugin of the Month: BruteProtect

A year after it launched to fight brute-force attacks, BruteProtect was acquired by Automattic and set to become part of Jetpack. That meant network-based login protection could reach millions of Jetpack sites for free.

Founder of the Month: Sam Hotchkiss

Sam Hotchkiss built BruteProtect from a side project into a funded company in under a year, then sold it to Automattic this month. He and his team joined Jetpack, bringing their security work to a much larger audience.

Looking Ahead to September 2014

WordPress 4.0 is due in the first week of September. WordCamp Europe takes place in Sofia, Bulgaria, on September 27–29, and attention will then turn to WordPress 4.1 and its release lead. BuddyPress 2.1 is also in beta.