I got the notice last night that WordPress 2.8.6 was released to fix a pair of security holes. So I hopped right into the admin console from my Iphone and in 2 minutes, it was updated. If you have a WordPress installation, I urge you to update right away as well. This will almost certainly be the last release prior to the much anticipated release of 2.9 which is our next major (feature related) release. Aaron Brazell had a great…
A new WordPress release came out last night. Unlike the previous, this is what they are calling “a hardening release”, i.e. it is generally designed to make the code base more secure, but doesn’t fix any known vulnerabilities. As with all minor level releases, I suggest you update as soon as possible, if for no other reason than to stay current. From their blog: A fix for the Trackback Denial-of-Service attack that is currently being seen. Removal of areas within…
The folks at Automattic released a security update for WordPress today due to a very specific bug: …a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. While this isn’t an incredibly nasty…
(Uh, Jeff, Kelly, move on, nothing to read here. Nothing of interest to you at all…really…) I had one of those moments today. Mistakes were made. Bad mistakes. The “oh crap, I’m editing on the production site, not the qa or dev server” type of mistakes that immediately have you picturing your career dissipation light suddenly burning bright. So I noticed after working on this highly important site that I’d accidently overwritten something on the live site. Yech. Luckily, as…
Over the past couple weeks, I’ve seen a lot more people making the switch to WordPress. Why not? The system is utterly configurable, with a plugin (or 5) for virtually every need. The problem is that not all plugins are of the same caliber. In fact, some are downright site killers. Since I’ve had a close look at a lot of them, I thought you all might benefit from a look at the plugins that I use on my personal…
The folks at Automattic today released WordPress 2.6.3 which is a minor security patch to the Snoopy script they use for displaying rss feeds in the admin area. Not an utterly crucial upgrade, but one you might want to take just to be sure your secure. The upgrade took me 5 minutes using the auto upgrade plugin. One issue that I noticed while using the auto upgrade plugin, which was also upgraded, was that the script failed repeatedly on the…
For the past couple months I’ve been devoting a lot of my time to the re-release of http://www.geek.com – the online technology resource and community for technology enthusiasts and professionals. We’ve added a lot of social networking tools, and also done a general wordpress/bbpress upgrade which will allow us to easily take the latest releases in the future. This is important on a couple of levels, first off, this is a site that has over 10 million unique users a month. That…
I remember when I first setup WordPress back in 2003, the old 1.x days, my comment was that “It’s just like a CMS (content management system) with most of the functionality removed.” Well, with the release of WordPress 2.6, I can finally eat my words. It’s now simply a content management system, and a darned good one at that. That’s right, content management system. To call it a blogging platform is to sell it short. It’s now all the features…
I ran into an interesting issue recently, and since I had so much trouble finding a solution, I’ll post about it. We have a very large WordPress site with somewhere around 32,000 posts. Sometime during may the database (MySQL 5.10) started to randomly crash, taking along with it the Apache server, etc. Every time the crashes occurred, we’d find that the number of users had climbed over the available processes, in this case, 501. We went through a whole host…
Last Wednesday I delivered a presentation entitled “WordPress Security 101” which got the discussions started in earnest about WordPress Security among our team. | View | Upload your own Here are the takeaways: Keep your blog up to date Don’t use plugins that aren’t in general public use unless you know who wrote them or have thoroughly reviewed the code Forms for reader upload/feedback are the single biggest point of attack – be sure if you code one you use…