Wordpress 2.8.5 Security Update
The Wordpress developers have released version 2.8.5 of their popular blogging software. The version is considered a security upgrade and therefor mandatory for all Wordpress blog owners who run their own Wordpress blog (but not those running a blog at Wordpress.com). The developers are calling this released a hardening release as it tightens Wordpress security to make Wordpress blogs more secure than before. The release is also fixing a Trackback denial of service attack that is currently in the wild.
The most important changes in Wordpress 2.8.5 are therefor:
- A fix for the Trackback Denial-of-Service attack that is currently being seen.
- Removal of areas within the code where php code in variables was evaluated.
- Switched the file upload functionality to be whitelisted for all users including Admins.
- Retiring of the two importers of Tag data from old plugins.
Wordpress blogs are currently not announcing the new release. It is expected that this will change in the next hours so that the automatic update option becomes available for Wordpress webmasters who use it to update their website. Webmasters who manually update their blog can visit the Wordpress page to download the latest version of Wordpress. Additional information about the security release are available in the blog post that announced the upgrade.
Tags: wordpress, wordpress security, wordpress update, wordpress upgrade