Ike.ninja

As teased earlier, the first release candidate for WordPress 3.9 is now available for testing!

We hope to ship WordPress 3.9 next week, but we need your help to get there. If you haven’t tested 3.9 yet, there’s no time like the present. (Please, not on a production site, unless you’re adventurous.)

To test WordPress 3.9 RC1, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the release candidate here (zip). If you’d like to learn more about what’s new in WordPress 3.9, visit the work-in-progress About screen in your dashboard ( → About in the toolbar) and check out the Beta 1 post.

Think you’ve found a bug? Please post to the Alpha/Beta area in the support forums. If any known issues come up, you’ll be able to find them here.

If you’re a plugin author, there are two important changes in particular to be aware of:

• TinyMCE received a major update, to version 4.0. Any editor plugins written for TinyMCE 3.x might require some updates. (If things broke, we’d like to hear about them so we can make adjustments.) For more, see TinyMCE’s migration guide and API documentation, and the notes on the core development blog.
• WordPress 3.9 now uses the MySQLi Improved extension for sites running PHP 5.5. Any plugins that made direct calls to mysql_* functions will experience some problems on these sites. For more information, see the notes on the core development blog.

Be sure to follow along the core development blog, where we will be continuing to post notes for developers for 3.9. (For example, read this if you are using Masonry in your theme.) And please, please update your plugin’s Tested up to version in the readme to 3.9 before April 16.

Release candidate
This haiku’s the easy one
3.9 is near

A serious overrun vulnerability in the
OpenSSL cryptographic library affects around 17% of SSL web servers which use certificates issued by trusted certificate authorities. Already commonly known as the
Heartbleed bug, a missing bounds check in the handling of the TLS heartbeat extension can allow remote attackers to view up to 64 kilobytes of memory on an affected server. This could allow attackers to retrieve private keys and ultimately decrypt the server’s encrypted traffic or even impersonate the server.

The Heartbleed bug write-up mentions
Apache and
nginx as being the most notable software using OpenSSL, and also points out that these have a combined active site market share of over 66% according to our

April 2014 Web Server Survey. However, not all of these servers are running an HTTPS service, nor are they all running vulnerable versions of OpenSSL with heartbeats enabled.

Our most recent
SSL Survey found that the heartbeat extension was enabled on 17.5% of SSL sites, accounting for around half a million certificates issued by trusted certificate authorities. These certificates are consequently vulnerable to being spoofed (through private key disclosure), allowing an attacker to impersonate the affected websites without raising any browser warnings.

Note that a small percentage of Microsoft web servers also appear to support the TLS heartbeat extension; these are actually likely to be vulnerable Linux machines acting as reverse proxy frontends to Windows servers.

Support for heartbeats was added to OpenSSL 1.0.1 (released in 2012) by Robin Seggelmann, who also coauthored the
Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) Heartbeat Extension RFC. The new code was committed to OpenSSL’s git repository just before midnight on new year’s eve 2011.

OpenSSL’s security advisory states that only versions 1.0.1 and 1.0.2-beta are affected, including 1.0.1f and 1.0.2-beta1. The vulnerability has been fixed in OpenSSL 1.0.1g, and users who are unable to upgrade immediately can disable heartbeat support by recompiling OpenSSL with the -DOPENSSL_NO_HEARTBEATS flag.

Popular sites which exhibit support for the TLS heartbeat extension include Twitter, GitHub, Yahoo, Tumblr, Steam, DropBox, HypoVereinsbank, PostFinance, Regents Bank, Commonwealth Bank of Australia, and the anonymous search engine DuckDuckGo.

Certificates and keys at risk of compromise should be revoked and replaced, particularly if they are used to protect sensitive data. Certificate Authorities, hosting companies and other interested parties can contact us for assistance in identifying affected certificates.

You can check whether your own HTTPS website might be vulnerable using the form below, and looking for the RFC6520 heartbeat TLS extension.

What’s Changed

[+] Service nodes can be deployed on CloudLinux.
[+] A new utility, called sync_resource_usage, is available for synchronizing information about resource usage between the Server Administration Panel and Hosting Panel.
[+] The hostname utility can update the host names of service nodes in PPA.
[+] During migration from Plesk or Plesk Expand to PPA 11.5, providers can keep their existing SmarterMail servers and connect them to PPA as service nodes.
[*] Migration of a large number of sites now takes less time.
[*] The stability of the migration tool was improved.
[*] The algorithm of service node selection for hosting Microsoft SQL Server databases was improved.
[*] Localization was updated for the following languages: German, Spanish, French, Japanese, Italian, Russian, Chinese simplified, and Chinese traditional.
[*] The calculation of hosted domains for licensing purposes was improved: now only physically hosted sites are counted.
[-] In some cases, the screens of Hosting Panel were not shown in full in Internet Explorer. (PPA-159)
[-] Dr.Web license keys could not be renewed automatically. (PPA-474)
[-] Users could not back up their subscriptions. Scheduled backups also did not work. (PPA-753)
[-] The daily maintenance task stalled during the calculation of disk space usage statistics. (PPA-805)
[-] Migration from Plesk 8 to PPA failed with the error “Error: Table ‘psa.horde.turba_objects’ doesn’t exist”. (PPA-822)
[-] Changing resource limits on a subscription could cause undesirable changes to website hosting settings. (PPA-13)
[-] FTP users could not be restored from backups created on IIS service nodes. (PPA-36)
[-] Users could not see log files for add-on domains in the Hosting Panel. (PPA-501)
[-] Administrators could not manage Microsoft SQL Server databases through Infrastructure > Database Servers > DB Webadmin. Wrong database administration tool was opened.(PPA-594)
[-] Domain forwarding configured by customers on webspaces could be reset to web hosting service after administrators or resellers changed the resource limits in the corresponding service template. (PPA-636)
[-] After upgrading from PPA 11.1 to 11.5, custom ProFTPD configurations were discarded and the operation of FTP server was disrupted. (PPA-646)
[-] Terminated license keys for Dr.Web could not be unassigned from service nodes. (PPA-724)
[-] Enabling of Apache service on PPA backup nodes could disrupt the operation of ProFTPD. (PPA-795)
[-] Webspace provisioning failed on Windows nodes with the error “SIDClient error: Unable to release input thread stack”. (PPA-853)
[-] Migration from H-Sphere could fail if the migration tool was run with the “set-dns-forwarding” option. (PPA-790)
[-] Migration from H-Sphere could fail if the SSH key access was used and the H-Sphere node was missing from the list of known hosts. (PPA-777)
[-] Users could not migrate from Plesk for Windows to PPA 11.5 if the destination service node in PPA was running Windows 2012 R2 with German locale. (PPA-751)
[-] Users could not migrate to PPA 11.5 if PPA used an external Microsoft SQL Server (which was added through Infrastructure > Database Servers). (PPA-771)
[-] Users could not transfer the contents of databases from H-Sphere to PPA if the administrator’s password for the destination MySQL server contained a bracket symbol ({). (PPA-774)
[-] Users could not upgrade the migration tool by using the command installer.sh –upgrade. (PPA-749)
[-] During migration from H-Sphere, user names were incorrectly transferred to PPA. (PPA-814)
[-] The migration tool showed error messages while migrating suspended subscriptions in multiple-webspace mode (“transfer-domains-to-subscription: same” in config.ini). (PPA-779)
[-] Migration from Expand installations with centralized mail could produce warning messages about duplicate domain administrator roles. (PPA-848)