WordPress News Roundup February 2018: WordPress 4.9.3 Breaks Auto-Updates and 4.9.4 Fixes It a Day Later

February 2018 delivered one of the more awkward weeks in recent WordPress release history. WordPress 4.9.3 shipped on February 5 with 34 bug fixes, but it also contained a bug that stopped sites from updating themselves automatically. WordPress 4.9.4 followed the next day, yet any site already on 4.9.3 had to be updated by hand. On the same day 4.9.3 arrived, a researcher published a denial-of-service technique against WordPress’s script loader that the project declined to treat as a core vulnerability.

The month also laid groundwork for May. A working group published a roadmap for GDPR tools in core, and the Community team brought back the WordCamp Incubator. Meanwhile, Gutenberg kept up its fast pace, and Matt Mullenweg answered community questions about it in a widely shared interview.

Mergers, Acquisitions, and Investments

No new major acquisitions were announced in February. The month was spent absorbing January’s two big deals: coverage of Liquid Web’s purchase of iThemes continued into early February, with reports that it was a multi-million-dollar, all-cash deal.

WordPress Core Updates

• WordPress 4.9.3: Released February 5 with 34 bug fixes for Customizer changesets, widgets, the visual editor and PHP 7.2 compatibility. It also contained an error in the auto-update code that caused sites to stop updating automatically.
• WordPress 4.9.4: Released February 6 to fix the bug. Sites that had already moved to 4.9.3 needed a manual update from the dashboard or their host, while sites still on older versions were unaffected. The core team later published the technical details.
• GDPR roadmap: On February 19, a new working group posted a proposed roadmap for GDPR tools, and by the end of the month it had formed a dedicated team and Slack channel for privacy work in core.
• Gutenberg: The editor received a feature-packed release on February 16, and Matt Cromwell hosted Matt Mullenweg for a Q&A about Gutenberg in the Advanced WordPress Facebook group.
• Two-factor authentication: The Meta team announced that two-factor authentication was coming to WordPress.org accounts, an important step for an account system with commit access to plugins and themes.

Other WordPress News

• WordCamp Incubator 2.0: The Community team announced the return of the incubator program, which helps underserved cities hold their first WordCamps, and opened applications for cities and experienced co-leads.
• Meetup roundtables: Weekly video roundtables for meetup organizers were scheduled through March.
• WordCamp statistics: The Community team published figures for WordCamps held in 2016 and 2017.
• Onboarding team: A proposal suggested a new team dedicated to helping new contributors get started.
• WooCommerce 3.3 pulled and fixed: WooCommerce 3.3 was temporarily removed from the Plugin Directory over theme template conflicts, and 3.3.1 followed on February 7.
• Jetpack 5.8: The plugin added a lazy loading module for images.
• 10up turns seven: The agency marked its seventh birthday in February.
• Events: A free virtual JavaScript for WordPress conference was announced for June 29, and WordCamp Orange County set a $3,000 first prize for its Plugin-A-Palooza contest.

Security Alerts and Plugin Vulnerabilities

• load-scripts.php DoS: On February 5, researcher Barak Tawily published a technique for overloading WordPress sites by asking load-scripts.php to concatenate a very long list of scripts in a single unauthenticated request. The issue was assigned CVE-2018-6389. WordPress said such attacks should be mitigated at the server or network level rather than in the application, and no core patch was issued, though hosts and firewall vendors added rules.
• Auto-update gap: The 4.9.3 bug was not a vulnerability, but it briefly left some sites unable to receive automatic security fixes until owners updated manually.
• Account security: The planned two-factor authentication for WordPress.org was welcomed as a defense against account takeovers that could be used to push malicious plugin updates.

Industry Trends and Insights

• Chrome and HTTP: Google announced that, starting with Chrome 68 in July, every HTTP page would be marked “Not secure”, effectively making HTTPS mandatory for any serious site.
• Privacy goes core: The GDPR working group moved privacy from a plugin concern to a core concern, a shift that would show up in a major WordPress release within three months.
• Release process lessons: The 4.9.3 incident showed how much WordPress’s reputation for safe updates rested on the auto-update system, and how costly a bug in that code could be.
• Performance features: Lazy loading in Jetpack reflected growing attention to page speed, years before lazy loading arrived in core.

Theme of the Month: Hestia

Hestia, ThemeIsle’s one-page business theme, had grown quickly since its launch in 2017. Its clean material-style design and support for WooCommerce and page builders made it a popular choice for small businesses that wanted a modern site without a premium theme budget.

Plugin of the Month: Jetpack

Jetpack 5.8’s lazy loading module gave millions of sites an easy way to delay off-screen images and speed up first page loads. At a time when page speed was a growing concern for search and mobile users, it was a simple, practical win.

Host of the Month: Liquid Web

Fresh from acquiring iThemes, Liquid Web was positioning itself as more than a server company. With Cory Miller helping shape its managed WordPress and WooCommerce strategy, it was building a hosting offer that came bundled with well-known WordPress tools.

Founder of the Month: Matt Cromwell

Matt Cromwell, co-founder of the GiveWP donations plugin, hosted Matt Mullenweg for a Gutenberg Q&A in the Advanced WordPress community he helped run. The interview gave plugin developers and agencies a rare chance to put their concerns about the new editor directly to the project lead.

Looking Ahead to March 2018

March was expected to bring more Gutenberg releases and progress on the GDPR roadmap, with the goal of getting privacy features into core before the May 25 deadline. WordPress 4.9.5 was also in planning.

WordCamp Miami was set for March 16–18, its tenth consecutive year, and meetup roundtables were scheduled every Wednesday in March.