This is the backstory… We pride ourselves on being transparent, honest and proactive when we talk to our customers. We’ve never avoided a challenging discussion and we’ll also be first in saying sorry when we have screwed up. The reality is that it doesn’t matter how awesome we are 99,9% of the time, we will have slip-ups, we will frustrate some users sometimes, and that’s why we are quick to apologize and quick to react & rectify a bad situation.
Back to the current day…
A couple of weeks ago, we were made aware of serious security flaws & vulnerabilities in the TimThumb script (by a 3rd-party developer), which we use to dynamically resize user images in our themes. We reacted immediately by updating & securing all of our themes and making these new versions available to our users. In our mind, we had taken due action, and based on the minimal bad reports we had from our users, this didn’t seem to be a widespread problem.
Things went relatively quiet for the few days after the blog post and we were helping out a small handful of our users that had been adversely affected by the security flaws. But then we started noticing that more & more users were complaining of an issue and two weeks after the initial blog post, we released further updates to our themes (to make it easy to spot & fix the vulnerabilities easily), as well as sending out an e-mail newsletter to all of our users, advising them that the issues were indeed critical and that it required urgent & decisive action on their part to resolve this.
If this is the first time you’re hearing about this, we suggest: 1)
Read this newsletter for information on how you can fix this; and 2) If you get stuck, please
contact us immediately, so that we are able to help you out!
Unfortunately this was too late for some of our users, who had already had their sites compromised as a result of the vulnerabilities. This is what we’ve learnt from this experience:
Continue Reading »