WordPress News Roundup January 2018: WordPress 4.9.2 Release, WP Engine Lands $250M From Silver Lake and Liquid Web Buys iThemes

January 2018 started slowly in core and fast in business. On January 4, WP Engine announced a $250 million strategic investment from Silver Lake, one of the largest investments the WordPress hosting world had ever seen. The month ended with Liquid Web acquiring iThemes, one of the oldest WordPress product companies, in an all-cash deal.

In between, WordPress 4.9.2 patched a cross-site scripting flaw in the bundled media player, Gutenberg reached version 2.0 with a focus on accessibility, and the wider tech world grappled with the Meltdown and Spectre processor vulnerabilities. With GDPR enforcement less than five months away, privacy was also moving up every WordPress business’s to-do list.

Mergers, Acquisitions, and Investments

January was one of the busiest months for WordPress deals in years.

• WP Engine raises $250 million: On January 4, WP Engine announced a $250 million strategic growth investment led by Silver Lake and said it had passed $100 million in annual recurring revenue. Part of the money was used to buy out earlier investors, and three Silver Lake executives joined the board. The new capital was also earmarked for international expansion under CEO Heather Brunner.
• Liquid Web acquires iThemes: On January 31, Liquid Web announced it had acquired iThemes, the Oklahoma City company behind BackupBuddy, iThemes Security and iThemes Sync. Founder Cory Miller stayed on as general manager and joined Liquid Web’s leadership team, and iThemes continued as an independent unit with its staff in place. Terms were not disclosed, though the deal was reported to be worth millions and paid in cash. As we now know, it was the first step toward the software portfolio that later became StellarWP.
• UpdraftPlus acquires Easy Updates Manager: The team behind the UpdraftPlus backup plugin bought Easy Updates Manager, a popular tool for controlling automatic updates.

WordPress Core Updates

• WordPress 4.9.2: Released January 16, it fixed an XSS vulnerability in the Flash fallback files of MediaElement, which were removed from core, and 21 other bugs. Fixes included JavaScript errors that stopped posts saving in Firefox, restoring the earlier behavior of get_category_link() and category_description(), and better restoring of widget assignments when switching themes.
• WordPress 4.9.3 delayed: The next maintenance release, planned for late January, was pushed to February 5.
• Gutenberg 2.0 and 2.1: Gutenberg 2.0 arrived in mid-January with numerous accessibility and keyboard navigation improvements, and version 2.1 followed on January 25 with more usability and technical changes.
• Coding standards: Work late in 2017 brought WordPress’s PHP code to near-full compliance with the WordPress coding standards, making automated checks practical for core.
• Plugin guidelines: The Plugin Directory’s detailed guidelines were significantly rewritten to be clearer and to cover more situations, with contributions now accepted through GitHub.

Other WordPress News

• Fifteen years since the fork: January 2018 marked 15 years since Matt Mullenweg’s blog post about forking b2, the idea that became WordPress. The anniversary of the first release would follow in May.
• Gutenberg learning resources: Zac Gordon launched a Gutenberg development course with more than 30 videos, and Ahmad Awais released a toolkit that simplified the process of creating Gutenberg blocks. WP Tavern also compiled a collection of Gutenberg conversations and resources.
• WooCommerce 3.3: Released January 30, it improved compatibility with themes not built for WooCommerce and regenerated thumbnails automatically. It would be briefly pulled in early February over theme conflicts.
• WPCampus Online: A free virtual conference on WordPress in higher education took place on January 30.
• Community goals: The Global Community team collected suggestions for its 2018 goals, and the new Hosting team reported progress.
• Remembering Efrain Rivera: The community mourned Efrain Rivera, a longtime member, WordCamp organizer and volunteer, who passed away at the end of the month.
• WP Weekly at 300: WP Tavern’s podcast marked its 300th episode with an interview with Matt Mullenweg about Gutenberg.

Security Alerts and Plugin Vulnerabilities

• MediaElement XSS: The flaw fixed in 4.9.2 was reported by Enguerran Gillier and Widiz. Since modern browsers no longer needed the Flash fallback, removing the files was the cleanest fix.
• Keylogger campaign returns: In late January, Sucuri reported that the group behind December’s cloudflare.solutions keylogger was back with new domains, and more than 2,000 sites had been infected in the new wave.
• Meltdown and Spectre: The processor vulnerabilities disclosed on January 3 did not target WordPress, but hosts spent the month patching servers, and some saw performance hits from the fixes.

Industry Trends and Insights

• Private equity arrives: Silver Lake’s investment showed that large financial firms now saw WordPress hosting as a mature, profitable market. It set the tone for years of private equity interest in the ecosystem.
• Hosts buying products: Liquid Web’s purchase of iThemes showed hosts moving beyond servers into plugins and tools. A few months later WP Engine would follow with StudioPress.
• Gutenberg readiness: With the new editor expected in 2018, developers rushed to learn React and block development, fueling a wave of courses and tools.
• The privacy countdown: GDPR enforcement on May 25 meant site owners, plugin authors and hosts all had to review how they collected and stored personal data.

Theme of the Month: Genesis Framework

StudioPress founder Brian Gardner appeared on WP Weekly in January, a reminder of how influential the Genesis Framework had been for a decade of WordPress sites. Its child-theme model, focus on clean code and big developer community made it a favorite of agencies, and its future would soon take a new turn.

Plugin of the Month: UpdraftPlus

UpdraftPlus, one of the most widely used backup plugins, expanded its portfolio by buying Easy Updates Manager. Pairing backups with control over automatic updates made sense, since the best time to take a backup is just before an update runs.

Host of the Month: WP Engine

WP Engine started 2018 with $250 million in new investment and more than $100 million in annual recurring revenue. The funding gave it the resources to expand internationally and invest in its platform, and it would put some of that money to work within months.

Founder of the Month: Cory Miller

Cory Miller founded iThemes in 2008 and built it into one of WordPress’s best-known product companies. Selling to Liquid Web after a decade was a milestone for the commercial WordPress world, and Miller’s decision to stay on as general manager helped reassure iThemes customers and staff.

Looking Ahead to February 2018

WordPress 4.9.3 was set for February 5 with dozens of bug fixes, and Gutenberg releases were continuing roughly every two weeks. A working group was forming to plan privacy tools for core ahead of GDPR.

On the events calendar, WordCamp Miami was preparing for its tenth consecutive year in March, and WordCamp Europe 2018 in Belgrade continued its speaker selection.