WordPress News Roundup January 2016: WordPress 4.4.1, the WP Engine Breach Traced to Linode and the 4.5 Cycle Begins

January 2016 picked up where December left off. WordPress 4.4.1 arrived in the first week with a security fix and dozens of bug fixes, and WP Engine identified the entry point for its December breach as its cloud infrastructure provider, which Linode confirmed days later.

With the holidays over, the WordPress 4.5 cycle formally began, the project ran its first global online contributor drive, and a series of data points published at the start of the year gave a clearer picture of who actually builds WordPress.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in January. Product launches took the place of deals: iThemes announced Stash Live, a real-time backup service, as it marked eight years in business, and Kernl launched hosted private update delivery for commercial plugins and themes.

WordPress Core Updates

• WordPress 4.4.1: Released on January 6, it fixed a cross-site scripting vulnerability reported by Crtc4L and 52 bugs from 4.4. Non-security changes included updated emoji support with the new diverse emoji, a fix for sites with older OpenSSL versions, and a fix for redirects to the wrong post when a URL had been reused.
• WordPress 4.5 kicks off: Development of 4.5 began in the first week of January under Mike Schroder, with release targeted for mid-April.
• Rethinking the editor: Designer Michael Arestad sparked a renewed effort to improve the content creation experience, an early thread in conversations about the editor that would grow much larger.
• Pace of releases: WP Tavern revisited Matt Mullenweg’s State of the Word answer to whether WordPress was moving too fast. He said three major releases a year would continue, apologised to those who felt the pace was too quick, and pointed to the REST API and better plugin directory tools as ways to ease the burden.

Other WordPress News

• Global contributor drive: WordPress announced its first global contributor weekend for January 30 and 31, focused on the support forums and aimed at people who had never attended an in-person contributor day.
• Who builds WordPress: Analysis published on January 5 found that 63% of WordPress core committers were not employed by Automattic. The same week, figures showed WordPress.org had added 910 themes in 2015, and WordPress.com reported more than 655 million comments published during the year.
• GlotPress becomes a plugin: GlotPress, the translation platform behind translate.wordpress.org, became available as a WordPress plugin on January 19.
• WordCamp news: WordCamp Europe 2016 in Vienna sold out and organisers sought more space, WordCamp US opened applications for its 2017–2018 host city, and WooConf 2016 early-bird tickets went on sale.
• Jetpack 3.9: Introduced a sitemaps module on January 21.
• #ilovewp: WordPress.org began revamping its testimonials page using an #ilovewp social media campaign.
• Global growth: Karachi’s first WordPress meetup drew 125 attendees, and Matt Mullenweg joined the Cape Town meetup for a live fireside chat.
• BuddyPress 2.5: Development began, alongside a new BuddyPress REST API feature plugin.
• REST API education: Human Made published a free REST API white paper ahead of its A Day of REST conference in London.

Security Alerts and Plugin Vulnerabilities

• WP Engine and Linode: On January 4, WP Engine said its investigation pointed to its cloud infrastructure provider as the entry point for the credential exposure disclosed in December. Linode confirmed a data security breach two days later that matched the attack.
• Core XSS: The 4.4.1 release closed a cross-site scripting hole affecting 4.4 and earlier, and rolled out through automatic background updates.

Industry Trends and Insights

The WP Engine and Linode episode highlighted how much managed WordPress hosting depended on infrastructure providers underneath, and how a breach at one layer could expose customers at another. Hosting choice remained a hot topic: WPShout’s 2016 hosting survey found that specialised hosts such as Flywheel, DigitalOcean, Kinsta and WP Engine scored well, though from a small sample of 135 respondents.

In the wider open-source world, maintainers of popular projects sent GitHub an open letter demanding better issue management, and GitLab moved quickly to court them. Drupal turned 15. For WordPress, the statistic that most core committers worked outside Automattic was a useful counterweight to perennial concerns about one company’s influence.

Theme of the Month: Pique

Pique, a free small-business theme from Automattic released at the end of December, was one of the first themes many new site owners met in January. Its front-page layout for small and local businesses showed how far Customizer-driven front pages had come.

Plugin of the Month: GlotPress

GlotPress’s move to a WordPress plugin made the software that powered WordPress’ own translation community available to anyone. Agencies and product companies could now run their own translation platforms inside WordPress, using the same tool the Polyglots team relied on.

Host of the Month: DigitalOcean

DigitalOcean was one of the specialised providers that scored well in WPShout’s January hosting survey. Its inexpensive virtual servers and one-click WordPress images appealed to developers who wanted control over their own stack, a different path from managed WordPress hosting.

Founder of the Month: Cory Miller

Cory Miller celebrated eight years of iThemes in January and launched Stash Live, bringing real-time backups to the company’s BackupBuddy line. He was also one of the community’s most open voices on mental health and burnout, a theme that would recur through 2016.

Looking Ahead to February 2016

February was expected to bring the first WordPress 4.5 beta and a decision on whether the REST API content endpoints would make it into the release. A second contributor weekend was planned, and feedback from A Day of REST, held in London at the end of January, was expected to feed into the API debate.