When WordPress.org techies noticed some suspicious “commits” (database changes) in their main repository, they didn’t dither but took immediate action. The changes were to the plugins AddThis, wpTouch and W3 Total Cache. The WordPress team promptly issued “rollbacks” (a rollback undoes a commit) and pushed the changes to users in case any had downloaded the suspicious plugins. Then, for good measure, they required password changes for WordPress users who want to commit plugins and themes, or use the forums.

If left alone, the commits might have given hackers back-door access to millions of WordPress blogs. Good work, WordPress team! Since this blog is hosted on WordPress, we’re doubly glad.

Sony, are you reading…?

Learn more from the WordPress blog ^[1] or at TheNextWeb ^[2].