Is Wordpress a TICKING TIME BOMB?
 

Interesting thesis at http://www.ixdownload.com/news/wordp...protected.html

Old WP installs + malware scanners + exploits = malware distribution enabling sites (via redirect)

Do most hosts do automated WP upgrades/updates?

you really cannot/should not automate WP upgrades/updates,
even a simple theme may not work between versions,
worst for pluggings, much worse for custom things

bump bump

i think it is...

i really think yes, if they find some exploit, it can be millions of sites down fucked "sharing" malware shit

hmmmm......I start to worry about this :smokin

Not only malware. Could be all kinds of stuff.
Child pornography, chat servers...

Too bad for the rogues it's such a solid piece of work.

your kidding right!

No .

Most scripts that are not custom written are potential ticking time bombs, be it Wordpress, Joomla, Drupal or any other system running in obsolete version. There's still a huge amount of online stores running on outdated versions of Joomla and Virtuemart, which are vulnerable for attacks.

With updating to newer versions, there are two problems that are both costly and time consuming to be solved. First of all, many extensions are not written properly, utilize hacks and exploit bugs specific to a single subversion of a script. Secondly, in many cases some features and functions can not be achieved by templating system and that's when some core CMS files are being changed and tweaked, making the system hard to update without breaking its functionality...

be smart, ive never had a wp site comprimised, lots of ways to protect the site

Dreamhost has auto updates as an option but you have to switch it on manually.

I guess the wordpress installs they run for you also update automatically (That's another option when you create one)

I just upgraded a blog that was running WP 2.0.2 to the newest version...

Nothing 'broke'. I am going through the code and upgrading all the obsolete functions, though.

And I've never had a WP site compromised. Take some basic steps in protecting it, though, as in, don't prefix your tables with "wp_". Close your eyes and hit the keyboard.

Mine is similar to "faiufs98sgfrngsri_". :)

Malware and exploits sure suck. Good luck.

http://securewordpress.com/

Came across this link a few weeks back, some pretty good info on securing your WP site.

My host requires manual updating on all their packaged installs. That's a good thing because all my shit is tweaked and custom. An auto-upgrade would not be cool. (although I don't use WP)

IMHO old releases are less vulnerable than new releases (off course if secured well and fixed). Every new release is a potential danger of security break. None of my wp installs was hacked yet and I don't have any spam as well.

it takes a few seconds to google for vulnerabilities for older versions of any software. it takes a little more to find up-to-the-minute hacks for newer releases.

Also, WP historically has been pretty good about releasing security updates quickly, within hours of major releases sometimes.

If updated, yes.

That's cause for concern. Although there might be a marketing opportunity here for hosting companies that have a lot of WP blogger customers. For a small fee they can do upgrades. As mentioned earlier though, the owner must be well aware re impact on themes/plugins that might not be able to handle the upgrade.

Wordpress, no matter how often it is updated, is precisely that.

its mainly these virtual hosts problem with running out of date software, hence why you should have your own vps or dedicated

That would be extremely sad if true. WP is an awesome platform. It's just sad that blog owners feel like they are playing "whack a mole" with all these updates...

As well as just things like keeping it up to date - which applies to any packaged script - how many people just install any old plugin off of a completely random site that they find it on with no idea what it is actually going to do and no understanding of code?

Shitty development, shitty code, so common it makes sense for blackhats to find a way to kill it.

Ask any of your managed host providers what they feel about WordPress. If you're lucky, you'll get a passive-aggressive shrug.

WP runs some some of the largest sites on the Internet without any issues or hacks. Don't use a lot of trash/unknown plugins, keep your skin clean and simple as possible, keep your wp updated. Then secure it, remove the header wp tags, pw protect the admin, shut comments off on old posts, and instead of blocking IP's in WP block them through the .htaccess file.

Exactly. Stay away from shady plugins.