10 Things You Need to Know About WordPress 2.6

WordPress 2.6 is around the corner, and as usual, there’s a bunch of changes, improvements, enhancements that have went into this version. In my opinion, this is an odd major release. While there are certainly major new changes that warrant a new major release, much of the release consists of various improvements generally saved for “dot releases”. Security and enhancement type stuff. The thinking is that WP 2.6 can be released so a WordPress 2.7 can come in the early fall timeframe and integrate new features developed in conjunction with the Google Summer of Code project.

NSA: in ur treo eavesdropping on u. Kthxbai

A story breaking in the security community but I’ve filed under “Does this surprise anyone, really? Come on!” has to do with smartphones running Windows Mobile. According to the filing from Cryptome.org reports that there is a Windows OS backdoor being used by the National Security Agency and agencies and contractors employed by the federal [...]

WordPress Plugin Security: The Golden Rule

As promised, today I begin an open-ended series on WordPress plugin security. How do you know what is secure? What tell tale signs might there be? How to train an untrained eye on code? But before we begin, we must establish a premise.
There are many kinds of security vulnerabilities. The most common vulnerabilities today lie [...]

Understanding Implications of WordPress Plugin Security

Early last year (an eternity ago, it seems), I wrote a series on PHP security that continues to be one of the top recipients of search engine traffic. Specifically, we talked about register_globals, remote file execution and the dangers of FTP.
Yesterday, I posted details about a cross-site scripting (XSS) exploit in a popular WordPress plugin [...]

Why Release Software Vulnerability Details?

For more than a week now, I have been aware of a very serious security flaw in a popular WordPress plugin. When a security flaw is discovered, there are a number of steps that must be taken to defend against a malicious hacker exploiting the flaw.

Secure affected sites against such an attack.
Notify software developer of [...]