> I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? I don't e

> I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? I don't entirely agree or disagree. It's a nuanced topic. The WordPress core team sat on a Unicode-based SQL injection flaw for years, after it was known to their team, then tried to sneak the fix in under the guise of Emoji support. https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ Part of fixing 0-days is minimizing the feedback loop from "bug known" to "bug fixed". The other part is minimizing the feedback loop from "bug fixed" to "fix deployed". To their credit, they at least try to solve the latter problem. To their detriment, if you compromise their update server, you've got RCE on just over 25% of the websites on the Internet. (Among other things, their update hooks use unserialize(), which allows for some fun exploitation techniques.) With Airship, root access to our update server doesn't let you forge updates. You'll need an airgapped Ed25519 signing key, and then you still have a catch-22 to resolve: A. Announce your presence to the network (untargeted attack) B. Find another way to hack every other Airship just so you can perform a silent, targeted attack against a single Airship. This catch-22 makes exploiting a pilfered signing key unattractive to nation states, who generally want their activities to be covert.