A zero day vulnerability has been recently found on TimThumb, a popular image resizing utility widely used in a lot of WordPress themes. This issue was first discovered and reported by Mark Maunder after his blog got hacked via the timthumb.php file/script.

The TimThumb zero day vulnerability allows malicious users, hackers and other third parties to upload and run PHP code in the timthumb cache directory. When the uploaded PHP code is run and executed, the attacker can do whatever they want with the affected site or blog.

Recommended measures:

If You Use TimThumb
If your current WordPress theme is using timthumb.php, make sure that you update to the latest version of TimThumb and to reglularly check on the official TimThumb site for updates and announcements.

Aside from updating the TimThumb file there’s another thing you need to do. Open up the timthumb.php or thumb.php file with a text editor and look for this line ALLOW_EXTERNAL and make sure that the value is set to FALSE.

define ('ALLOW_EXTERNAL', FALSE);

Once ALLOW_EXTERNAL is set to FALSE, next thing to do is remove the domains inside the $allowedSites array to ensure that remote file downloading is disabled:

Before

$allowedSites = array (
	'flickr.com',
	'picasa.com',
	'img.youtube.com',
);

After

$allowedSites = array ();

If You Do Not Use TimThumb
If you don’t use or need timthumb.php but have other WordPress themes stored in your wp-content/themes folder that uses timthumb.php, it is recommended that the timthumb.php or thumb.php file or even the entire theme or plugin folder be deleted/removed from your web server.

The theme I’m using here on JaypeeOnline – FreshNews by WooThemes uses TimThumb. After reading about this vulnerability, I immediately removed the thumb.php file and replaced it with an updated one. I was worried that I was using a very old version of TimThumb and that upgrading might mess up my blog but after the upgrade, I checked all the thumbnails and everything seems to be working fine. I also removed everything related to the old version of TimThumb and cleared the the cache.

If you want to know more about the TimThumb zero day vulnerability, how it was discovered and other additional info, check out Mark Maunder’s blog post.

The WordPress dev team released the first Release Candidate (RC1) for WordPress 3.2 a couple days ago. Release Candidates are versions of the software that are released after the beta phase and before the final release.

Some important stuff to tak note for those who are using/testing WordPress 3.2 RC1:

• WordPress plugin and theme authors are encouraged to test their plugins and themes now to make sure that all compatibility issues are discovered and addressed before the final version is released.
• WordPress users are also encouraged to test it and inform plugin or theme authors if you find any compatibility issues with any plugins/themes you use on your blog.
• You can find known issues for WordPress 3.2 RC1 here.

Here’s how/where you can submit bug reports:

• Post it to the Alpha/Beta area in the support forums or wp-testers
• Join the development IRC channel and tell us live at irc.freenode.net #wordpress-dev
• File a bug ticket on the WordPress Trac

Remember that WordPress 3.2 RC1 is meant for testing purposes so make sure you don’t install it on your main/live blog or website but rather install it on your test site.

Download WordPress 3.2 Release Candidate 1

Our previous giveaway – MediaLoot Elite Membership giveaway was for graphic artists, web developers and design aficionados. This time, I have something special for all WordPress fans and users out there. In cooperation with WPMU DEV and AppSumo, JaypeeOnline will be giving away 3 1-year WPMU DEV Elite Memberships worth $420. For those who aren’t familiar with WPMU DEV, it is one of the best sources for all your WordPress needs – themes, plugins, support, etc.

So what do you get with a WPMU DEV Elite Membership? Access to over 100+ plugins for WP, Multisite and BuddyPress, 150+ premium highly customizable themes and unlimited live and forum-based help and support. Aside from those, you also get the following:

• Unlimited use of all plugins & themes, forever!
• Upgrades and support guaranteed
• Helpful live chat and forums
• Access to all new plugins & themes
• New feature development requests
• Full access to WPMU Jobs

Here’s some of the most popular WPMU DEV products:

• WP Membership – The most powerful, easy to use and flexible membership plugin for WordPress, Multisite and BuddyPress sites available. Offer downloads, posts, pages, forums and more to paid members.



• MarketPress – The complete WordPress ecommerce plugin – works perfectly with BuddyPress and WP Multisite too to create a social marketplace, where you can take a percentage!



• Premium WordPress Themes

CONTEST MECHANICS:
(choose either Twitter or Facebook. You can do both if you want but you won’t any extra points for it.)

via Twitter

1. Follow WPMU DEV @wpmudev, AppSumo @AppSumo and JaypeeOnline @jaypee.
2. Retweet this post. Please use the exact tweet below including the bit.ly shortlink and make sure to mention @WPMUDEV, @AppSumo and @jaypee on your tweet.

Win a WPMU DEV Elite Membership worth $420 from @wpmudev @AppSumo @jaypee – http://bit.ly/m0Pcyc

3. Leave a comment on this post to let us know that you joined the contest. Please include the link to your tweet and your Twitter ID/username.

via Facebook

1. Share this post on Facebook. Please use the exact message below including the bit.ly shortlink.

Win a WPMU DEV Elite Membership worth $420 from WPMU DEV, AppSumo & JaypeeOnline – http://bit.ly/m0Pcyc

2. Leave a comment on this post to let us know that you joined the contest. Please include the link to the Facebook post and your Facebook ID/username.

Contest starts as soon as this post is published. All entries should be in by midnight of June 29th (US Eastern Time). Three (3) lucky winners will be chosen using Random.org’s List Randomizer and their names will be announced the following day – June 30th.

Coincidentally, AppSumo’s deal of the day is a WPMU DEV Elite Membership for only $79. This usually costs $420 so with this deal, you get an 81% discount and $341 savings. If you don’t feel lucky joining this giveaway, you can take advantage of this awesome deal. Check out the official WPMU DEV promo page on AppSumo*

*The MediaLoot AppSumo deal starts on June 7th at 12AM CST and ends after 11:59:59 PM CST

Btw for those who aren’t aware, I’m currently having a 1,500 business cards giveaway courtesy of AllBusinessCards.com. I’ll also be posting another giveaway within the next few days so watch out for it.

Blogging

• The 5 Forgotten Keys to Extraordinary Blogging Success
• Using Pop Culture to Influence Your Reader
• 3 Ninja Ways To Get Backlinks
• How To Tell Your Friends And Family About Your Blogging Job

WordPress

• How to Easily Disable Theme Changing
• 4 Ways To Start an Auction Site with WordPress
• How to Add Facebook Open Graph Meta Data in WordPress Themes
• WordPress 3.2 New Dashboard and Twenty Eleven

SEO

• Google Panda Algorithm Exploit Uncovered
• SEO for YouTube : Advanced Tricks
• Google Analytics Now Tracks Page Load Speed
• Optimising Video For Search Engines

Social Media

• Social Media Strategy In Four Steps
• Do You Have Social Media Clout?
• Skip the Social Media Bandwagon and Pursue Your Passion!
• Social Search: Personalization of the Web

Technology

• An IP Address Does Not Point To a Person, Judge Rules
• New Rechargeable Battery Uses Water
• Google Allows Carriers To Ban Tethering Apps
• Aaron Computer Rental Firm Spies On Users

Gadgets

• Trim Slice Tegra 2 Smarttop
• The World’s Smallest Video Camera
• MSI announces 4th Generation Smart Touch AIO-Wind Top AE2070
• Tiny CrazyFlie Quadrocopter

Pinoy Blogs

• Nokia E6 in the wild running on Symbian Anna
• Lenovo IdeaPad U260 Review
• LG Optimus Black P970 : Price, Specs, Photos
• Send Email Using @facebook.com from Gmail

JaypeeOnline Weekly Recap

• Got Myself An Android Tablet
• 1,500 Business Cards Giveaway from AllBusinessCards.com
• WordPress for BlackBerry 1.5 Now Available
• Distraction Free Writing Mode Coming to WordPress 3.2
• iOS 4.3.3 Software Update
• 8 Ways to Increase Your Sites Conversion Rates
• Exclusive Video of Osama Dead [Facebook SCAM]
• Celebrities Who Cosplayed

If you have any questions, comments, suggestions or would want to share your article or any interesting story that you found in the Internet and have it featured in the next Weekend Roundup, feel free to leave a comment or send me a message via the contact page.

To celebrate Easter, WooThemes is having a weekend sale on all their premium theme packages and club subscriptions. Instead of the regular 2-for-1 promo where you can purchase two premium WordPress themes for the price of one, this weekend they’re offering a 5-for-1 promo for any of their WordPress theme packages plus 20% off club subscriptions.

Here’s the full details of the WooThemes Happy Easter Promo:

• Standard Theme Package – $70 for 5 themes.
• Developer Theme Package – $150 for 5 themes and their Photoshop files.
• Enterprise Themes – $160 (20% discount).
• Standard Club Membership – $85 start up fee and $15/monthly subscription with access to 90 themes (20% discount).
• Developer Club Membership – $140 start up fee and $20/monthly subscription with access to 90 themes and their Photoshop files (20% discount).

If you’ve been waiting or wanting to purchase a premium WordPress theme from WooThemes, now is the best time to do it. You don’t often get this much discounts on beautiful quality premium WordPress Themes. Of course, all of this includes access to the WooThemes support forum and help from the Woo ninjas.

NOTE: This offer is valid until Monday, April 25th.

What are you waiting for? Take advantage of the WooThemes Happy Easter promo get 5 premium WordPress themes for the price of 1 or get huge discounts on WooThemes club subscriptions!

Go and check out the WooThemes Happy Easter Promo