WordPress 7.0.2 went out today with two important security updates. One is a type of pre-authorization RCE we (fortunately!) have only seen a few times in WordPress’ 23-year history; the last, I believe, in the PHPMailer class five years ago.
Major kudos to Adam Kues of Searchlight Cyber for finding the batch REST API RCE, to TF1T, dtro, and haongo on the facilitated SQL injection!
Thanks to responsible disclosure, the WordPress.org Security team was able to coordinate with hosts and CDNs to mitigate the attack at the network layer. Please upgrade anyway! But it’s a huge relief to know the vast majority of WordPress sites were protected by defense-in-depth even before the updates went out.
I really appreciate how people and organizations that otherwise might not be on the best of terms come together in times like this. (Full credits in the release post.) Everyone buries the hatchet to protect as many people as possible as quickly as possible.
I’ve said it before, I’ll say it again: security is going to be a big topic this year as the technology industry digests the incredible advances in AI models. It’s a good time to review your plans and processes, sweat the details, invest in maintenance, and hug a sysadmin. 🙂
When I went to the first WordCamps in Beijing and Shanghai in 2009, it was a very different time. They were the biggest in the world at the time! I don’t think you could take photos in Tiananmen Square as freely as I did then; now to visit I think you need an appointment, ID checks, and security checks.
Even during WordCamp, it felt like the freedom of Open Source was in high demand, but it also created a lot of fear. I found out later that one of the student volunteers who helped their professor organize everything had been taken in for hours of questioning following the event.
On that trip, I saw how fine-grained the Great Firewall could be when individual posts (IIRC, about bad milk from a factory harming babies) wouldn’t load, but the rest of the site would. WordPress.com had been totally blocked, taking about a quarter of our traffic at the time, but behind the Firewall, Open Source continued to thrive and grow, and now the frontier open models are being driven by China in a way I never would have predicted!
Once you’ve had a taste of freedom, it’s hard to go back.
Update: You can now watch the entire thing online:
On a globe, America is a landmass, a country. In an immigrant’s heart it is a belief that future is almost always better. It may not be perfect and it is certainly not equal, but it still is one of a kind — the only place where an absolute stranger with a funny name and a funny accent with no friends or contacts can show up, work hard and actually get to do what he was destined to do. […]
In most places in the world, outsiders like me don’t have that chance. That simple truth is what makes America so special. A chance – to be somebody even if you are nobody. America is a state of mind and I have opted-in!
I feel lucky to have been born here, and if I hadn’t been, I think I would have gotten here as fast as I could. I’m grateful to the public schools that educated me, the teachers who pushed me, the internet that freed my mind, and the culture of risk and innovation in technology that invested a million dollars in a 21-year-old dropout kid trying to build a company around (but not replacing) an Open Source project.
It’s not unimaginable that these things could have happened someplace else, but it would have been a long shot.
There has been a lot of excitement about the OmFest idea. If you’d like to attend or contribute, please fill out this form as soon as possible so we can gauge the type of venue we need.
I do wish he had been more public earlier in his health journey. You never know what you’ll learn. I’ll take that as a lesson for myself if I’m ever in a similar situation.
There have been some great long-form writings about Om:
Om introduced Krutal Desai as his son. “He had a rare gift of seeing 20 steps ahead while explaining things with remarkable simplicity. He gave wisdom freely, never seeking credit, only wanting to help others succeed.”
Susan Hobbs. “He was a teddy bear to those fortunate enough to know him. […] Om created gravity. He was someone you wanted to be around.”
Helena Price shares her thoughts and an old interview of Om. “If you believe and you can’t seem to do anything other than think about something, you’ve just got to keep doing it. I think the universe has to follow. What’s the point of living if you don’t chase what’s important to you?”
Toni Schneider. “Om was a wonderful person, artistic soul, and original thinker. He was always curious, generous, and warm-hearted.”
Sean Bonner. “[H]is feedback and criticism could be sharp – but it was always with the hope that things could be better.”
John Battelle. “Om quickly decided his integrity was more important than the ad dollars he was making with Federated”
Winnie Lim. “Om was one of the very few people in this world I can have an intense conversation about form and content with.”
Glass.photo. “It’s not lost on us that Om’s photography, often taken in frozen lands in or around the arctic circle, was the polar opposite of his personality.”
I knew Om contained multitudes, but sitting by his side these last few weeks, I’ve been amazed to learn how many deep and completely separate communities he was part of. He meant so much to so many, in so many different ways.
Om loved putting on a good conference, and I’d like to celebrate his life with an awesome event on September 29, 2026 (his 60th) in San Francisco, like an OmFest. (Update: Sign up here!) I’ll find a space where every community from the many facets of Om can come together. In the spirit of Open Source and co-creation, we can have some booths, flash talks, a gallery of his photography, pen showcase, and whatever other fun ideas people want to contribute. I can’t wait for the beautiful collision of his tech / journalism / Indian party planner / pen / coffee / shoes / photography circles, and probably some niches I couldn’t even imagine.
A Few Vignettes
I have so much to say about Om, but right now I’m working on moderating comments and keeping his website tip-top, so here are a few snippets:
Fundamentally, Om was a lover of humanity. He became a fast “regular” everywhere he went. He wouldn’t just buy coffee, he would also learn the name and story of every barista, the dogs and people in South Park. His deep curiosity and respect weren’t just for the fine and famous. It extended to every soul that crossed his path. His encyclopedic knowledge and photographic memory created connections not just in San Francisco, but all around the world wherever we traveled. (I need to pull the stats, but we went to five continents together, including Antarctica.)
He loved people and their stories.
Om and I were an odd couple. We met online through forums and email because Om was one of the earliest adopters of WordPress. We finally met in person in 2004 when I was 20 and he was 38. He connected me to the first investors I ever spoke to, Phil Black, who formed True Ventures, and Tony Conrad, and introduced me to Toni Schneider, my business soul mate, who became like a co-founder as the CEO of Automattic in our first 8 years.
And of course on the internet. I don’t know how we would count, but I would guess Om read at least 1 or 2% of the whole thing.
Om was a voracious learner. I was there when he first used chopsticks, and only a few months later, he knew every sushi restaurant in San Francisco and exactly what he liked at each.
One of the biggest lessons I learned from Om is the deep appreciation of craft. When he took an interest in photography or pens, he would somehow find his way to the most obscure, highest-quality expression of that form. “What Would Om Want?” is a question I will always ponder. I want to craft products that would make Om proud.
Om’s last word was “love.”
In a jitney on our trip to India in 2009The day Om became a US citizen In NYC with the True crew, 2008Matching dyed blonde hair, 2016With a golden heart, 2025
Nothing Gold Can Stay, by Robert Frost
Nature’s first green is gold, Her hardest hue to hold. Her early leaf’s a flower; But only so an hour. Then leaf subsides to leaf. So Eden sank to grief, So dawn goes down to day. Nothing gold can stay.
A throwback from 2007: a local Bay Area a cappella group called The Richter Scales made a Webby Award-winning viral video about how that bubble felt. Hat tip: Toni.
In honor of Father’s Day, I wanted to add to the two quotes from my Dad’s obituary, “Seven days without chicken made one weak.” and “If you fail at raising your children, nothing else mattered.” with another saying he had.
A typography savant on staff had spent a month designing link underlines (literally just lines) that were more visually pleasing than Chrome or Safari’s defaults. On Tuesdays, engineers stayed late at the office, fixing design imperfections over dinner. One of them began a 2,500-word post about Medium’s CSS code with a quote attributed to Lil Wayne: “I believe that to be the best, you have to smell like the best, dress like the best, act like the best. When you throw your trash in the garbage can, it has to be better than anybody else who ever threw their trash in the garbage can.”
From Harris Sockel’s essay What Happened to Medium, which I think is meant to be a dunk? But I think it’s awesome. Medium’s design and typography has always been really impeccable. I love when people obsess like this.
I’m sorry I couldn’t be there in person, but I was so excited to watch the Midjourney Medical launch from afar. This is a really big deal. David Holz, one of the most underrated pioneers in AI, has taken money from making cat pictures to build a full-body ultrasound scanner that can give you incredible visibility in 60 seconds.
You can re-watch the livestream here, which I recommend. You might remember David from Leap Motion, which I blogged back in 2012. It’s so cool to a small but mighty independent company innovate and apply learnings across seemingly disparate sectors.
I wish all my friends in jazz and the arts who are despondent about tech could meet David:
“We’re going to be a little confusing for the next six months as we announce all the things, but I’m hoping as they all are out there, they form a picture which I hope feels cohesive. Most of them are around creativity, but some of them, like this, are just around positive human futures that we actually want to be a part of. And I think this is an important thing for AI companies to do—for all humans to do.” — David Holz
If you understand imaging, you know the tradeoffs between X-ray, CT (computed tomography), MRI (magnetic resonance imaging), and ultrasound, and Midjourney’s approach doesn’t cover everything, but what’s incredible is the speed, amount of data, and using AI to process and get something useful out of it. Ultrasonics will be an incredibly exciting area over the next few years, first for imaging and later for intervention. I can imagine a future where you dip into one of these once a month just to keep an eye on things, not just to find bad stuff but to see the impact of exercise or dietary changes.
We’re fairly new to scanning healthy people, and I always advise friends getting their first whole-body MRI with Biograph or Prenuvo that it’s very common to hear something scary at first, only to find it’s benign. Also, I’ve now heard many examples of things that were caught and treated early, years before they might otherwise have been noticed.
That led me to discover how awesome Balmuda is, and stumble upon the Japanese word Monozukuri, which, according to Google, “(ものづくり) is a foundational Japanese philosophy that translates literally to the art and science of making things” It goes far beyond standard manufacturing or production, representing a deep, holistic mindset that embraces craftsmanship, a relentless pursuit of perfection, pride in one’s labor, and a deep respect for materials.” Look at how Toyota embodies it.
WP.cloud is our AWS; Pressable is our demo site. We want every host to offer the fastest and most secure WordPress possible. I’m happy to focus on infrastructure and let others figure out marketing and such foofram.
If you speak Danish and would like a random Radical Speed Month art project detour, check out Joen Asmussens’ Nima.
Much of this came from those not historically in a product or engineering role, which we’re learning to navigate. I loved how customer-centric many things were. We also made a lot of rookie mistakes, but that’s part of how you learn, and I believe the acceleration of learning will be the biggest legacy of the Radical Speed Month experiment. That, and the fun games on our intranet. 🙂
AI Hangover
I have drunk from the sweet nectar of Waymo, and now find myself calling an Uber so I can talk to 72-year-old Antoly from Azerbaijan, whom I slip a hundred-dollar bill as I step out. I weep when I see talented colleagues speak and write with words not quite their own. I masochistically Pangram everything even though it sometimes mistakes my own hand-crafted prose for slop, or is that actually my soul being sanded down by consuming too many statistically probable next tokens?
The uncanny valley of software, writing, products, and presentations so polished on the surface but built on thin foundations of understanding gives me an almost physical, nauseous reaction. I write this even as I listen to Claude FM music for thinking and building, probably Mythos-injected with subliminal messages to remind me of the hours of audio transcribed in minutes; the programs that would have taken a team months, conjured from my hand in hours; the way I feel like Neo in the Matrix, rapidly downloading new domains of knowledge.
What’s the name for the paradox, like Jevon’s, that AI abundance and polish makes you crave messy, imperfect humanity even more?
It’s good to debate and ruminate, but only in small doses. Like salt in a dish, a little goes a long way. Avoid the existential angst of charting new territory by getting your hands dirty and trying things. You learn the most from failures when you can laugh at yourself. Build one to throw away.
Write Different
Writing is not the most important thing; thinking is. But writing is probably the best way to improve your thinking.
Cześć wszystkim, Kraków… I made the call not to fly to Poland for WordCamp Europe. I’m very sorry for the last-minute notice; I was really hoping to make it. I’m okay, but I want to stay close to loved ones going through difficult times.
I’ll watch all the sessions so if any WordCamp speakers would like feedback on their talk, just fill out this form, and I’ll write something up and message it to you on the .org Slack.
I really appreciate the love and support I received after the WP23 post, and I do want to tell people I’m okay, the post was part catharsis and part giving voice to what I see and hear privately from people who aren’t public figures.
On weekends, I like to look back on the week and find a silver lining or learning from things that were challenging. It helps reframe things. After it was reported that I had 21 hours of depositions over 3 days, people were like “wow that must have been terrible,” but actually, while the prep and process were intense, I found it energizing and I learned a ton. Will post more about that later. You never know where things will lead.
WordPress 6.7 in November 2024 was named in honor of Rollins.
We rarely choose a living musician for a release so the team actually prepared a gift we sent to him with the names of all the contributors.
Mr. Rollins, Your immense contributions to music are a source of deep inspiration to the thousands of open source contributors to WordPress. We like to say ‘Code is poetry’, and we’re honored to pay tribute to you and your legacy of creativity and innovation by naming the 6.7 release of WordPress to you.
It was sent to his publicist, so not sure if he got a chance to see it, but I hope it at least gave him a chuckle to have a random Open Source project celebrating him.
It’s very cool to see Theo / t3.gg‘s open source arc.
Just in general, with people creating more software than ever, it’s so exciting to see an explosion of open source and a growing understanding of why working together on open source makes so much sense for the future we want to build.
You call yourself a Christian engineer, but you haven’t given your life to Open Source? Huh.
What license would Jesus choose? I don’t know if it’s GPL or MIT, but sure as heck it isn’t proprietary.
Letting proprietary code dictate your life is like following a Bible you’re not allowed to read. Beware those who would seek to mediate your relationship to the divine.
Happy Easter, y’all. 🙏🐰🌈
Update: BTW, the above would probably be a lot better if I spoke it, because people would hear a very humorous tone, but that’s not clear from the text! So some have said I come off pretty jerky, and some said blasphemous. Fair! I’m also not saying it’s literally funny, it just would be a little clearer I was trying.
Also, I mean examples as possible metaphors or parallels and not literally, but never say that up front. Also as thought experiment, not literally as judgey. “No” or “it is totally fine” are valid answers to the first question, lots of more possibilities — the “Huh” is meant more out of curiosity than judgment, a conversation starter, not an ender.
Finally the ender “Happy Easter, y’all)”in my Houston culture and context / the South would be pretty clear as actually happy, friendly and playful. But said in a different tone or without that context, the opposite! I have friends in NYC for whom that would read deep sarcasm, a big FU and rude bye. I didn’t think of that!
Anyway, I’ve learned a lot from the feedback, will probably still learn more, and want to deeply appreciate the people who care enough to give it to me and spend time explaining and answering my questions. Thanks, y’all! (Not sarcastic 🙂 🙂 🙂 <— Real smiles and gratitude, not smug.)
I’m not thanking all the Twitter / X trolls, though, and I’m not going to engage any more because the real or perceived trolling makes it almost impossible to change, nor do I harbor any illusions of changing some minds. I’ve devoted hundreds of hours to it in the past, but it didn’t help, and that took a lot of time away from my favorite people and loved ones.
(Also, I think something has changed; in open source and WordPress, we’d fight like crazy, but ended up coming together or having a meal afterward before diving back in. Social media I think has made that rarer and harder.)
(and the new Spring colors are on the site.)
If you’re looking for a good watch this weekend, I couldn’t recommend more the documentary Turn Every Page – The Adventures of Robert Caro and Robert Gottlieb. The craft of research, writing, and editing is presented in the most beautiful way possible. Around 400,000 words were removed from The Power Broker, which was ultimately published as 1,162 pages.
This Ashlee Vance interview of Pedro Franceschi from Brex contains so many interesting stories it might cause you to reconsider what it means to be a CEO.
