Typically what happens is that a plugin contains a weakness (a vulnerability) that allows an attacker to compromise individual sites that use that version of a plugin. But these compromises are ...

It’s a new year, but drama in the WordPress community keeps going. Automattic, the company that runs WordPress.com, said that it would reduce its contribution to WordPress core, the open source ...

The idea of open-source software seems kind of nuts. Millions (billions?) of lines of code doing all kinds of amazing things and available for free? That sounds too good to be true. But it is true.

WordPress announced a major clampdown to protect its theme and plugin ecosystem from password insecurity. These improvements follow a flurry of attacks in June that compromised multiple plugins at the ...

A long, long time ago, I built websites by hand using the vi editor to write HTML. It was hard. Then along came NoteTab and Bluefish, which made writing and editing HTML easier but still a pain.

WordPress has released version 6.4.2 that addresses a remote code execution (RCE) vulnerability that could be chained with another flaw to allow attackers run arbitrary PHP code on the target website.