There's even more work to be done on the WordPress front (and PHP in general for that matter): making automatic updates secure even if the server gets hacked.

There's even more work to be done on the WordPress front (and PHP in general for that matter): making automatic updates secure even if the server gets hacked. https://core.trac.wordpress.org/ticket/39309 https://core.trac.wordpress.org/ticket/39309 https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat I'm currently writing a pure-PHP libsodium polyfill that, once audited, will be proposed to shore up the security of PHP projects the whole world over. Among other things, this means that everyone will be able to adopt Argon2i for password hashing even if they support PHP 5.2.4 like WordPress does. Ideally, everyone would get in the habit of updating to the latest versions more rapidly. But when 27% of the Internet runs software that refuses to modernize, that becomes a huge risk to the rest of the Internet.