WordPress News Roundup September 2009: A Worm Hits Old WordPress Sites and Automattic Buys After the Deadline

September 2009 began with a wake-up call. In the first days of the month a worm spread through old, unpatched WordPress sites, quietly creating administrator accounts and injecting hidden spam and malware into posts. On September 5 Matt Mullenweg responded with a blunt post on WordPress.org: the only reliable protection was to upgrade.

Days later Automattic announced its purchase of the After the Deadline proofreading service, and the month closed with BuddyPress 1.1, a theme directory that had passed 1,000 entries, and the surprise news that the SimplePie feed parser used by WordPress was ceasing development.

Mergers, Acquisitions, and Investments

• Automattic acquires After the Deadline: On September 8 founder Raphael Mudge announced that Automattic had bought his spelling, style and grammar checker, a deal he said had closed in July. Terms were not disclosed. The tool was rolled out on WordPress.com, the plugin stayed free for non-commercial use, and Automattic released the underlying technology under the GPL a few weeks later. Mudge joined Automattic to keep working on it.

WordPress Core Updates

No new WordPress version shipped in September. WordPress 2.8.4, released in August, remained current and was confirmed to be immune to the worm, as was the release before it. Development of 2.9 continued, with a beta expected later in the autumn.

• Legacy support debated: In the wake of the attacks, community members asked whether WordPress.org should maintain older branches for longer, a question the project had answered in July by retiring the 2.0 line.
• Install profiles proposed: Ptah Dunbar suggested “installation profiles” that would set up WordPress with a chosen set of plugins, themes and settings, an idea similar to the install profiles offered by Drupal.

Other WordPress News

• BuddyPress 1.1: Released on September 30, BuddyPress 1.1 introduced the new single-theme architecture announced in August, replacing the two themes required by 1.0.
• Theme directory passes 1,000: The WordPress.org theme directory reached 1,000 themes at the end of the month.
• Plugin competition winner: Section Widget by Godfrey Chan was named winner of the Weblog Tools Collection plugin competition, and Ozh’s reviews of the entries prompted a proposal for a volunteer plugin validation team.
• WordCamp Portland: Portland’s WordCamp took place in mid-September with a live video stream and lively Twitter coverage.
• Plugin authors step back: Developer Matt Martz announced he would stop maintaining several of his plugins, highlighting the strain on volunteer developers.
• Commercial themes and WordPress.org: StudioPress said traffic from WordPress.org’s commercial themes page had declined, raising questions about the listing’s value.

Security Alerts and Plugin Vulnerabilities

The worm was the most visible attack on WordPress sites to date. According to Matt Mullenweg’s “How to Keep WordPress Secure” post, it registered a user, exploited a permalink bug fixed earlier in the year to run code, promoted itself to administrator, used JavaScript to hide from the users screen and inserted spam and malware into older posts.

• Who was affected: Only outdated installs. WordPress 2.8.4 and the preceding release were immune.
• Hiding the version doesn’t help: The post noted the worm tested for capabilities rather than version numbers, so hiding a site’s WordPress version offered no protection.
• The advice: Upgrade, check friends’ blogs and help them upgrade too. Strong passwords and server rules could help, but the post argued that upgrading was the only lasting defence.

Industry Trends and Insights

The worm exposed a structural problem: WordPress’s popularity meant a long tail of neglected installs that attackers could harvest automatically. It strengthened the case for making upgrades easier and more visible, a theme that would drive core work through the following year.

• SimplePie ends development: On September 28 the SimplePie project, whose library WordPress used to parse RSS feeds, announced it was ceasing development, raising questions about how WordPress would maintain bundled third-party code.
• Proofreading as a feature: The After the Deadline deal showed Automattic investing in writing tools rather than only infrastructure.

Theme of the Month: Atahualpa

BytesForAll’s Atahualpa was one of the most popular free themes in the WordPress.org directory, offering an extensive options page that let users change layouts, colours and fonts without code. As the directory passed 1,000 themes, Atahualpa represented the type of flexible, configurable theme many users were looking for.

Plugin of the Month: After the Deadline

After the Deadline checked spelling, style and grammar using context rather than simple word lists, and its September acquisition by Automattic put it in front of every WordPress.com user. For self-hosted sites, the plugin offered the same help inside the post editor.

Host of the Month: WordPress.com VIP

Automattic’s VIP service hosted high-traffic publishers on WordPress.com’s infrastructure, with Automattic handling upgrades and security. In a month when outdated self-hosted installs were being compromised, a fully managed option made a clear case for itself.

Founder of the Month: Raphael Mudge

Raphael Mudge built After the Deadline, caught Matt Mullenweg’s attention after posting about it on Hacker News, and sold it to Automattic in a deal announced on September 8. He stayed on to develop the tool, which was later folded into Jetpack.

Looking Ahead to October 2009

October was expected to bring the first call for WordPress 2.9 beta testing and possibly a further 2.8 point release focused on hardening. WordCamp NYC tickets were due to go on sale ahead of the November event.