WordPress News Roundup October 2009: WordPress 2.8.5 Hardening Release and Plugin Compatibility Beta

October 2009 was about making WordPress harder to break and easier to upgrade. The core team shipped WordPress 2.8.5 on October 20 as a dedicated “hardening” release, back-porting security improvements developed for 2.9, including a fix for a trackback denial-of-service problem that was being actively exploited.

At the same time, WordPress.org tackled the biggest reason people gave for not upgrading, fear that plugins would break, by launching a plugin compatibility beta. With 2.9 nearing its first beta, the project spent the rest of the month recruiting testers and organising bug hunts.

WordPress Core Updates

• Getting ready for the 2.9 beta: On October 12 WordPress.org asked users to help test the features built for 2.9 as the first beta drew close.
• WordPress 2.8.5: Released on October 20, 2.8.5 fixed the trackback DoS issue, removed code paths that executed PHP stored in variables, applied an allowlist to file uploads for every user including administrators, and retired two importers for tag data from old plugins. Users were encouraged to scan for signs of past compromise with the WordPress Exploit Scanner plugin.
• Plugin compatibility beta: On October 28 the project introduced a compatibility feature developed by Michael Adams, letting users report whether a plugin worked with a given WordPress version. The data would feed into the 2.9 upgrade experience.
• Bug hunts announced: On October 31 WordPress.org invited developers who had never contributed to core to set up development environments and join upcoming bug hunts for 2.9.
• Developer chats: Weekly #wordpress-dev chats covered better upgrade notifications, a friendlier default first post for new installs and proposals to reduce repeated admin markup.

Other WordPress News

• BuddyPress adds a core developer: On October 30 Andy Peatling announced that John James Jacoby had joined the BuddyPress core development team.
• WordCamp NYC tickets: Public registration opened in mid-October for the November 14–15 event, organised with help from Jane Wells.
• After the Deadline goes open source: Automattic released After the Deadline’s core technology under the GPL, following through on a promise made when it announced the acquisition in September.
• Hyperlocal publishing: WordPress Weekly devoted an episode to hyperlocal news sites and how BuddyPress could power them, reflecting experiments by local newsrooms.
• Community chat: WPChat.com launched as a simple chatroom for WordPress users that required no registration.
• Exporter in core?: WP Tavern argued that features from the Advanced Exporter plugin should be built into WordPress’s own exporter.

Security Alerts and Plugin Vulnerabilities

After September’s worm, October’s focus was prevention.

• Trackback DoS: The headline fix in 2.8.5 addressed a denial-of-service technique using trackbacks that attackers were already exploiting.
• Upload restrictions: Limiting uploads to an allowlist of file types, even for administrators, reduced the risk of attackers using compromised accounts to plant executable files.
• Clean-up guidance: Pointing users to the Exploit Scanner plugin acknowledged that many sites hit in September might still carry hidden code.
• Lowering the bar, raising the risk: Commentators debated how far WordPress should go in making itself easy for beginners when inexperienced owners were also the least likely to keep their sites patched.

Industry Trends and Insights

Open source CMSs were gaining credibility in high-profile places. In late October the White House relaunched whitehouse.gov on Drupal, a widely covered endorsement of open source publishing that WordPress developers watched closely. The same week, Yahoo shut down GeoCities, a symbolic end for the hosted homepage era as self-hosted platforms took over.

• Upgrade anxiety: WordPress.org’s compatibility project addressed the human side of security, accepting that people avoided upgrades because they feared breakage.
• Volunteer capacity: Calls for first-time core contributors showed the project trying to widen its developer base as the codebase and user base grew.

Theme of the Month: BuddyPress Default

The bp-default theme arrived with BuddyPress 1.1 at the end of September and became the reference design for community sites in October. It handled the blog, member profiles, groups and activity pages from one theme and served as a parent for custom community designs.

Plugin of the Month: WordPress Exploit Scanner

Recommended in the 2.8.5 release notes, the WordPress Exploit Scanner searched a site’s files and database for suspicious code such as hidden links and encoded scripts. For owners worried that September’s worm had left traces behind, it was the first tool to reach for.

Host of the Month: Rackspace Cloud

Rackspace’s cloud hosting arm offered scalable servers and managed cloud sites to publishers whose WordPress installs were outgrowing shared plans. As traffic spikes and attacks both became more common, the ability to add capacity quickly was a growing consideration.

Founder of the Month: Mark Ghosh

Mark Ghosh founded Weblog Tools Collection, one of the longest-running WordPress news sites, and its annual plugin competition had just crowned a winner at the end of September. The competition encouraged new developers to release free plugins and gave the directory a steady stream of fresh ideas.

Looking Ahead to November 2009

November was set to bring the first WordPress 2.9 beta and the bug hunts announced at the end of October. WordCamp NYC on November 14–15 was the month’s biggest event, and the winners of the 2009 Open Source CMS Awards were also due.