When writing informative information regarding updates to WordPress it’s always worries me that people will get the wrong idea about WordPress. Although the program does go through a lot of minor updates this should instill further confidence in people that the core WordPress team (and the many contributors) care about their product. I have yet to see an organisation that reacts so swiftly to possible security threats.

The latest of these threats comes from within the community that uses your blog (registered users), if you feel that you have contributors to your site that may be a little shady then this update is for you. If however you are the sole contributor to your Blog/Website then this will not affect you.

The recently found exploit allows users who are able to upload images, Video’s etc to inject and execute arbitrary PHP code on the hosting server. In laymen’s terms this means that someone could upload a PHP piece of code disguised as an image. The images is disguised by altering its file name in the following way BadPHP.php.jpg leaving WordPress to assume that you added an image, however when the file is called (for example as part of a post) the PHP code is allowed to run.

Thankfully as usual the WordPress 2.8.6 update will resolve this issue.

This week New Time Media has been delving into the most hyped product in years Google Wave. After watching the introduction video that explains the logic and thinking behind the product, I myself like many others have been itching to try the new piece of kit. Although at the time of writing Google Wave is only available by invitation there is already a bucket load of plug-ins and advise floating around on the internet; just type Google Wave WordPress in a Twitter search and you’ll see what I mean. After a few trial runs and option scanning the first thought where positive, however as with all new concepts cautions is always taken; am I looking at something I’ve already got, only served differently?
By far the most exciting aspect of Google Wave for me was the integration into blogs; a concept that I’m sure will open new avenues for social networking ideas. Searching WordPress.org I stumbled across this rather useful plug-in from Lucas Caro which allows WordPress to use the Google Wave Embed API. As Waves is still in Beta format, so is this plug-in, so caution should be applied. Once Google Wave has been fully released in a stable format a more serious attempt can be made at creating simple integration for WordPress, until then I’m sure this plug-in will do just fine for those looking into this exciting product.

Further analysis by the WordPress core team has unearthed a few more possible areas of security. This as all updates should be implemented by WordPress self hosting sites at the first opportunity. For more information on this and other WordPress related issues visit WordPress official site

WordPress Blogs may wish to take the warning in their Dashboard to upgrade to 2.8.4 a little more seriously than previous updates.

The main reason for updating to WordPress 2.8.4 is due to a major security flaw found by the WordPress community. This update prevents a worm that is currently doing the rounds from attacking and compromising WordPress blogs prior to version 2.8.4.

For the full story click here