Between 10:00 PM and 11:59 PM Pacific time on Saturday, January 24, each of our hosting servers will be restarted. This will cause a brief interruption of service (less than 10 minutes) for each site at some point during this 2 hour period.
The researchers at Sucuri yesterday announced that they’ve discovered a critical security bug in the widely used Pagelines/Platform WordPress themes. If you use one of these themes or their many derivatives, “hackers” can easily take over your site unless you update the theme.
Since many of our customers use these themes, so we’ve added security rules to block attacks even if you haven’t updated. And we’re glad we did: our logs show that a large Chinese botnet started attacking every WordPress site we host last night, in alphabetical order (they’re currently up to domain names starting with “e”), testing whether each site is vulnerable to the bugs.
We’re again surprised to see how many customers are using versions of these themes that haven’t been updated in years. I know we sound like a broken record, but when WordPress offers to update something you’ve installed, you must update it if you want your site to stay secure.
Although we haven’t offered the long-obsolete PHP 5.2 series to new customers for some time, some who signed up long ago are still using it.
(New customers have defaulted to using PHP 5.5 for the last few months, and PHP 5.3 was the default for several years before that. We’ve also previously nagged everyone still using PHP 5.2 by e-mail, asking them to upgrade to at least PHP 5.3.)
For those customers still using PHP 5.2 despite the nagging, this is just a quick note that we’ve “rebuilt” PHP 5.2.17 for technical reasons to allow it to keep running on our systems. It now uses slightly newer versions of various libraries, including libxml, FreeType, ImageMagick, MySQL, and OpenSSL. The rebuilt version will be deployed on all our servers within the next few hours.
These changes should not be noticeable. In the unlikely event you experience any trouble, don’t hesitate to contact us.
The PHP developers recently released versions 5.4.36 and 5.5.20 that fix several bugs. We’re upgrading PHP 5.4 and 5.5 on our servers as a result. This will be complete on all servers by 5 PM Pacific time on Monday (January 6).
In addition, PHP 5.3.29 has been upgraded to use ionCube Loader 4.7.3.
These changes should not be noticeable, but in the unlikely event you experience any trouble, don’t hesitate to contact us.
We’ve recently upgraded the Dovecot mail server software we use, and a new feature allows us to do something we’ve wanted to do for a long time: compress stored mail on our servers. We’ll be starting to do that over the next few weeks.
Compressing mail happens invisibly on our end. It makes no difference to what you see in your mail program, and you don’t need to do anything or worry about it.
The benefit to our customers is that it saves 20-30% of the disk space the messages use. While most of our customers don’t store very large amounts of mail on our servers, those who do will see their disk space usage drop by 20-30%.
Our business offices will be closed on Thursday, January 1 to observe the US legal holiday. As always, our support staff will be providing same-day support for time-sensitive issues via our ticket and e-mail systems. However, questions that aren’t time-sensitive (including most billing matters) may not be answered until Friday, and telephone support (via callbacks) will be available only for urgent problems.
Our business offices will be closed on Thursday, December 25 to observe the US legal holiday. As always, our support staff will be providing same-day support for time-sensitive issues via our ticket and e-mail systems. However, questions that aren’t time-sensitive (including most billing matters) may not be answered until Friday, and telephone support (via callbacks) will be available only for urgent problems.
If you’ve previously installed an older version of WordPress, you should update it from within your WordPress Dashboard.
By the way, the new WordPress 4.1 Twenty Fifteen theme doesn’t display a default navigation menu, unlike earlier themes. To ensure you’ll always see a list of the pages on your site, our installer now adds a Pages widget at the top of the sidebar for new installations. If you later create a custom navigation menu, you’ll see two lists of pages in the sidebar. You can just delete the extra Pages widget if that happens to you.
I’m going to use annoyingly big type, on an annoying yellow background, because it’s important:
If you think “I won’t update that for a while because I’m concerned about compatibility”, like many people, you’re setting up yourself up for failure unless you have a specific plan to apply the update in the near future (by which we mean hours, not days). Otherwise you’ll just get further and further behind, and updating will become harder and harder, then you’ll be even more likely to be hacked every day.
Due to a problem with the Mailman list management software, some Mailman list mail sent yesterday (December 2) and this morning (December 3) was delayed (although most was delivered normally).
We’ve resolved this. All delayed list mail has been delivered, although some messages may have arrived out of order due to the delay.
- Brief scheduled maintenance January 24, 2015 (completed)
- Protection against WordPress “Pagelines” and “Platform” theme security bugs
- PHP 5.2 rebuilt (but please don’t use it any more)
- PHP 5.4.36 and 5.5.20
- Compression of stored e-mail
- New Year’s (2014/2015) Holiday Hours
- Christmas 2014 Holiday Hours
- WordPress 4.1
- Out-of-date WordPress sites will get hacked
- Some Mailman list mail delayed (resolved)