WordPress 2.8.5 Another Security Release
Most of you that frequent your self-hosted WordPress site should be well aware of the new version, 2.8.5 now available. As with all incremental security releases, it is recommended that you upgrade as soon as possible.
What I consider an incremental upgrade is when it goes something like from 2.8.4 to 2.8.5. This kind of small version change usually has no major enhancements and should have a pretty painless upgrade. When there are major changes like the upcoming release of version 2.9, then I would recommend waiting a week or so for some of the bugs to be found and fixed. I would suggest either researching any new major release or wait for the first incremental version of it to be released. And remember with all upgrades always backup first!
From the official WordPress.org site regarding version 2.8.5:
The headline changes in this release 2.8.5 are:
* A fix for the Trackback Denial-of-Service attack that is currently being seen.
* Removal of areas within the code where php code in variables was evaluated.
* Switched the file upload functionality to be whitelisted for all users including Admins.
* Retiring of the two importers of Tag data from old plugins.
We would recommend that all sites are upgraded to this new version of WordPress to ensure that you have the best available protection.
If you think your site may have been hit by one of the recent exploits and you would like to make sure that you have cleared out all traces of the exploit then we would recommend that you take a look at the WordPress Exploit Scanner. This is a plugin which searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames. You can read more about this plugin here – “WordPress Exploit Scanner“
When upgrading this site I encountered the “WordPress Upgrade Error Allowed Memory Size Exhausted” error. So I had to do the work-around to increase the memory limit by adding a bit of code to my wp-config.php file discussed on this previous post: WordPress Upgrade Error Allowed Memory Size Exhausted.
Similar Posts:
- Another Security Release WordPress 2.8.4
- WordPress Upgrade Error Allowed Memory Size Exhausted
- WordPress Upgrade Precautions
If you liked this post, feel free to leave a comment that is relevant to the post or subscribe to the feed and get future articles delivered to your feed reader.
Sorry but due to the spamming of a few all comments are moderated and will appear when approved and all drive-by comments will be deleted!
Comments
Those security updates…. What about making WordPress a little bit more stable and reliable?
Reply
As soon as this update came out I upgraded all of my Wordpress blogs immediately. I wonder if static sites have so much work to be secure? That is something that is totally worth looking into. I haven’t installed the Exploit Scanner plugin yet. I better get started on that asap.
All the best,
Eren
Reply
maybe I should wait until WP 2.9 release for update all my blogs…
Reply
Jeff Replied:
October 26th, 2009 at 8:05 am
If you don’t have 2.8.4 or higher then your blog is vulnerable to getting hacked.
Reply
Yeah 2.8.4 helps alot to prevent hackers. its a must have !
Reply
Absolutely, Security is very important! But I am just very eager to see what WP 2.9 will have in store for us.
Tech-Freak Stuff´s last blog
Reply
Hi..
I agree with reiki healing… security is very important especially nowadays to protect against like spammers and etc.
Reply
When I tried to auto upgrade, it gave me a message successfully upgraded, but when I tried to login my site account again I wasn’t able to… it showed some 500 error but my main site was opening…. I am now upgrading Wordpress manually…
Reply
Upgraded immediately no compromise on security, waiting for 2.9 now…
Reply
I thought wordpress was the most secure bloggin script. I used to use phpbb the forum script and got my site hacked 2-3 times even after constant updates. So far so good with wordpress. and in fact i am enjoying every bit of it. its really a great tool. thanks to matt and his team to put in the efforts.
Reply
Brent2 Replied:
November 1st, 2009 at 4:22 pm
Part of the reason WordPress is so secure is their constant attention to security. If an exploit is found, even a miner one, they have an update very quickly.
We noticed a significant amount of WordPress accounts being hacked and, after reviewing the hacks to ensure it wasn’t our problem, waited for WordPress to release something. Took them all of 2 days to find the most obscure hack I’d ever seen. Poof. 2.8.5.
Reply
I am sick and tired of the frequent WP updates. When you have over 50 blogs to look after (I hire writer and manage a fairly largish network), it can get annoying. Unless there’s a major security issue, I just wait and upgrade every few versions… Otherwise, I’d be spending way too much time doing upgrades.
That said, at least the installs and upgrades are relatively hassle free and it still is the best blogging platform out there
Reply
Well if you have multiple blogs it’s quite a hassle to upgrade everyone of them everytime, but it’s also not a good idea to leave them vulnerable, so probably better to upgrade right away anyway…
Reply
I was using wordpress version 2.8 and was facing lots of problems, especially the file upload bug. It simply irked upon my nerves. I had downgraded then and now I won’t be upgrading till I get a good number of feedback from a few users.
Reply
I stopped using Wordpress recently because of all the bugs i was facing. I wish they would bring out a clean, user friendly version for Linux
Reply
Every hacker knows Wordpress has a user “admin” with god-like administration privileges. Slow the hackers down by removing the “admin” user. Create a Wordpress user with admin privileges using the administration interface. Log out of Wordpress and log back in with the new user. Delete the admin user. The new admin user should be different than your normal post author.
Reply
I love Wordpress, but all the updates are driving me crazy. It seems like there’s a new release every week. I know it’s good that they are patching holes to keep me safe and what not, but still…
Reply
I don’t get that small-time updates either. Why can’t that update wait until the next version? More importantly, how can one small problem not be detected before being upgraded into a new version?
Reply
I also wait at least a few weeks before upgrading to the latest version to give the wordpress team the time to iron out rough corners and fix bugs. It’s time for me to upgrade now.
Reply
I thought wordpress was the most secure bloggin script. I used to use phpbb the forum script and got my site hacked 2-3 times even after constant updates. So far so good with wordpress. and in fact i am enjoying every bit of it. its really a great tool. thanks to matt and his team to put in the efforts.
Reply
Good post and you are Absolutely,right Security is very important! But I am just very eager to see what WP 2.9 will have in store for us keep posting hanks man.
Reply
I heard that a 2.9 beta is coming soon….
Maybe this December
Wordpress rockz and i have to say that the antispam measures are fantastic… I rarely get spam messages to my e-mail anymore
Go wp go
Reply
so.. another wordpress update (…) lucky I only have a few blogs on wordpress, updating a new version really takes time. But glad to know it has better security than the previous version
Reply
hackers adapt to their environment, sadly. updates get made, hackers find a loophole, new updates are made, and it goes on and on. but at least wordpress developers are keeping up on their game. we need to constantly backup our databases!
Reply
Wordpress is still the best blogging platform for me i really love wordpress, but these weekly updates are starting to wear me out.thanks
Reply
It is annoying that word press is making frequent and small updates. I can’t wait for word press 2.9. I hope we will see the update soon great post keep posting thanks a lot.
Reply
There is a discussion of WordPress 2.9 tomorrow at the WordCamp NYC 2009. Looking forward to that as my last few upgrades up from 2.7 have not gone perfectly. Regards,
Reply
The DOS attack became very common in WordPress platform.One of my WordPress blogs was exploited using the same problem and I stopped using it as I thought it has been hacked but now after installing these Updates I have to see again.
Reply
I know almost all of us are waiting eagerly for the new features instead of security updates. But the security of our blog is equally important.very informative post.
Reply
WordPress 2.8.5 is not new for us because we know that very soon we will find new one that is 2.9. So wait for it, its in the way.
Reply
As soon as this update came out I upgraded all of my Wordpress blogs immediately. I wonder if static sites have so much work to be secure? That is something that is totally worth looking into. I haven’t installed the Exploit Scanner plugin yet. I better get started on that asap.
All the best,
Reply
I agree with Anne that for people running multiple blogs, the continual updates can be very time consuming. Sometime back I did start changing the default “admin” to different master usernames and deleted that one. It’s at least one step toward slowing down potential hackers.
Reply
very nice info, one of my blog use wordpress and fortunetly my hosting support for one click upgrade. only one click from my cpanel then my blog has upgrade to higher version
Reply
I will wait for WordPress 2.9 release. then i will update my all blogs.
Reply
As soon as this update came out I upgraded all of my Wordpress blogs immediately. That is something that is totally worth looking into. hope wordpress is getting better
Reply
Thanks for this link:WordPress.org site Jeff, I think that WordPress 2.8.5 is great.
Reply
i had been upgrade, and i never know it, because my wordpress before this was hacked by someone from middle east. thanks for share us..
Reply
Leave a comment
Drive-By comments will be deleted! Like "Thanks for sharing", "Nice post", or any other text that doesn't contribute to the discussion. If you ask a very specific question about your particular WordPress theme, it will probably be deleted. I can fix your WordPress site but for a price. If you ask a question like "Why don't my blog work right", it will be deleted. If you ask a question about your WordPress site without a leaving a link to it, it will be deleted. The point is to ask questions and or comment on the the actual content of the post, and to please use some common sense. All comments are moderated and will appear when approved. Thank you.