Remember to check your WordPress plugins often

Third Party News
1

Howdy all,

I just saw this pass by on one of my feeds and figured now is as good a time as any to remind everyone again to keep a close eye on security updates, now more than ever.

I know Updraft is a pretty popular plugin for WordPress, so if you’re using it…get on this, sounds potentially quite serious:

1 Like
2

what are you recommendations on automatic updates?

for me

  • Critical sites e.g. eCommerce/Mission Critical I have no automatic updates
  • For ma and pa sites (eg 5 page sites etc…) I have
    • plugin automatic updates on
    • minor WordPress updates only

Using a real cron for WordPress makes these updates guaranteed and allows your site to run smoother without using the pseudo cron.

3

I’m hesitant to suggest any automatic updates now. There have been so many supply chain attacks…including WordPress plugins. e.g. there was the recent giant pile of WordPress plugins that were acquired and immediately injected with malware. So, an official upstream update included malware…if you updated immediately after those got released, you got popped.

I’m recommending:

  1. Minimize plugins. If you don’t really need it, get it out of your systems.
  2. Keep up with who owns/develops your plugins.
  3. Read the release notes or change log. If it’s open source, look at the actual commits.

I don’t like it, but things are getting hairy out there.

1 Like
4

This is definitely the new meta and I had forgotten about it. WordPress Org should do something about this. I certainly will not be using that other plugin website or that fork of WordPress.

5

The WordPress folks have been doing stuff about it for years. They scan for known malware, etc. and they removed all of those plugins and banned the developer and rolled a repair patch with the next version of WordPress.

But, we live in dangerous times. Machines with only modest guidance can find and exploit software at rate far faster than humans can fix it.

1 Like
6

Tell me about it.

Lock it down folks.

The internet never had enough controls before in my honest opinion, AI is just an unbridled demon stallion running free to cause untold havoc …

Flee.

David

1 Like
7

Thanks, Joe. Good to know about this.