WordPress News Roundup September 2013: WordPress 3.6.1 Release, WordPress 3.7 Beta Brings Automatic Updates as Automattic Buys Cloudup

September 2013 showed the new release model working. WordPress 3.6.1 patched the summer release, and at the end of the month the first beta of WordPress 3.7 arrived with a feature that would change how millions of sites were maintained: WordPress that updates itself. Plans for a redesigned admin in 3.8 also became public.

Automattic made its fourth acquisition of the year, a designer-focused managed host opened its doors, and WP Tavern gained a writer who would shape its coverage for years.

Mergers, Acquisitions, and Investments

• Automattic acquires Cloudup: On September 25, Automattic announced it had acquired Cloudup, the file-sharing service built by the team behind LearnBoost, including Guillermo Rauch. Coverage at the time said the team would work on WordPress.com’s media handling and collaborative editing, while Cloudup continued as its own service.
• Simplenote relaunched: Eight months after the Simperium deal, Automattic released a refreshed Simplenote, and Matt Mullenweg wrote about the new apps on his blog.

WordPress Core Updates

• WordPress 3.6.1: After nearly 7 million downloads of 3.6, 3.6.1 shipped on September 11 with 13 bug fixes and three security fixes: blocking unsafe PHP unserialization that could lead to remote code execution (reported by Tom Van Goethem), stopping Authors from creating posts “written by” other users, and fixing an open redirect. Upload restrictions were also tightened to reduce cross-site scripting risk.
• WordPress 3.7 Beta 1: Beta 1 introduced automatic background updates, with test installs updating themselves nightly and emailing results to the admin. It also brought a stronger password meter based on Dropbox’s zxcvbn library, search results ordered by relevance, advanced date queries in WP_Query, and automatic downloading of translations for importers and default themes. A 3.7 release was planned for October and 3.8 for December.
• Post by Email to leave core: The team decided to remove the Post by Email feature from core in favour of an official plugin, the same project a summer intern had been building.
• Documenting every hook: A new effort began to add inline documentation for every action and filter in WordPress, laying groundwork for a future developer reference.
• Admin redesign planned for 3.8: Late in the month it became clear that MP6 was the leading candidate for a refreshed dashboard in WordPress 3.8.

Other WordPress News

• Sarah Gooding joins WP Tavern: On September 3 WP Tavern announced Sarah Gooding as a writer, a hire that significantly expanded the site’s daily coverage.
• Pressgram launches: John Saddington launched Pressgram, a photo-sharing app that published to WordPress sites. It sparked lively debate in the community and inspired open-source alternatives within days.
• The Year Without Pants: Scott Berkun’s book about his time leading a team at Automattic went on sale in mid-September, offering a rare inside look at the company’s distributed culture.
• REST API momentum: Ryan McCue explained his work on a JSON REST API for WordPress, which had started as a Google Summer of Code project.
• WP App Store post-mortem: Brad Touesnard explained why the WP App Store, a commercial plugin and theme marketplace, had failed.
• WordCamp Detroit cancelled: Organisers explained why WordCamp Detroit 2013 would not go ahead.

Security Alerts and Plugin Vulnerabilities

The main security news was WordPress 3.6.1. The unserialization fix addressed a class of bug that could allow remote code execution in limited setups, and the release was credited to responsible disclosure by researchers, including one working on behalf of the US Centers for Disease Control and Prevention.

Industry Trends and Insights

• The end of manual security updates: Automatic updates promised to fix the oldest problem in WordPress security, sites that never updated.
• WordPress.com’s scale: WordPress.com was reported as the eighth most visited site in the US, underlining Automattic’s reach.
• Passwordless login experiments: Services such as Clef, which let users log in with a phone, reflected growing interest in alternatives to passwords after the year’s brute-force attacks.

Plugin of the Month: Clef

Clef replaced the WordPress password with a smartphone app that scanned a moving pattern on the login screen. In a year defined by brute-force attacks, it offered an easy two-factor-style login for people who would never set up a traditional authenticator.

Host of the Month: Flywheel

Flywheel opened to the public on September 24, positioning itself as managed WordPress hosting built for designers and agencies. Its focus on that audience and a friendly dashboard set it apart from developer-oriented competitors.

Founder of the Month: Guillermo Rauch

Guillermo Rauch, co-founder of LearnBoost and creator of the popular Socket.IO library, joined Automattic with the Cloudup acquisition. Bringing a respected open-source JavaScript developer into the company signalled Automattic’s interest in real-time, JavaScript-heavy tools.

Looking Ahead to October 2013

WordPress 3.7 is targeted for October, with more betas and release candidates first. WordCamp Europe takes place in Leiden, the Netherlands, on October 5–7, and the 3.8 feature plugins, MP6 among them, will keep maturing ahead of a December release.