7 ms·

Oh god, this gave me a minor heart attack. We are using over 20 ACF fields for 150+ sites. I thought it was completely out of the WordPress ecosystem. I am glad

Oh god, this gave me a minor heart attack. We are using over 20 ACF fields for 150+ sites. I thought it was completely out of the WordPress ecosystem. I am glad they have the zip download and continuing auto updates. EDIT: I confirm our ACF plugins on sites are all switched to secure custom fields. This is so shady, it broke our snippets because we are using prepend and append texts to wrap our field values. Now they are all broken and we have to update all our sites (also our client's sites). Let's see what comes next... EDIT2: There goes my Sunday. I received our first ticket regarding broken homepage widgets. I have to sit down and update every site one by one. Thank you Matt Mullenweg for ruining my Sunday plans.

gg-plz 2y ago
As someone who doesn’t use it, were those features removed into the patch? If they’re actively breaking people’s sites I’d hope they can get an emergency injunction ASAP, and maybe someone can start a CFAA investigation.
yawnxyz 2y ago
this is my nightmare
btown 2y ago
This should be the top comment. It's already scary for a package manager to take control of a community package, even more so when sites auto-update to new code... but to break existing sites by completely changing the code that is provided in an auto-update is beyond the pale. Not a lawyer, but I imagine many consultancies will be talking to lawyers about this one; there are entire sections of law about interfering with other companies' contracts with each other. At minimum it's an appalling breach of trust.
- didgeoridoo 2y ago
  “Advanced Tortious Interference”
  - sharphall 2y ago
    "Secure Tortious Interference"
Cyberdog 2y ago
How did the sites auto-update to have this plug-in removed/replaced? Are your sites set up to just automatically take push updates from WordPress central command or something and auto-modify themselves?!
- sgdfhijfgsdfgds 2y ago
  Wordpress has a (highly effective) auto-updates mechanism for security patches. It was extended a couple of years ago to automatically apply plugin updates for you if you opted in, and I think automatic plugin updates may now be the default. (This is on balance a good thing; almost all WP vulnerabilities are outdated plugins, and until this mechanism was prevalent, WordPress occasionally had to live-patch existing installations of third party plugins in the case of severe vulnerabilities.) The reason this nasty little takeover worked is that they (Matt, whoever helped) have stolen ACF's slug (advanced-custom-fields). So as far as the updater is concerned, it's just another plugin update to the same code base. And in fact, very little has changed.
  - arielcostas 2y ago
    IDK if WordPress plugins respect SEMVER, but shouldn't this auto-update thingy update only patch versions, or minor versions at most? Idk, breaking changes like these is definitely not something you want your CMS to do overnight when you won't notice until you receive complaints that your site is broken
    - sgdfhijfgsdfgds 2y ago
      Yeah. I don't know off-hand what the rule is for plugin updates, actually; I'd have to look it up. As far as WordPress itself is concerned, the updater definitely does not auto-push updates to major WP versions by default [0], and they continue to patch older versions for a long time. But at any rate, whether the plugin updates respect SEMVER or not, Matt/WP.org pushed this bullshit out as the most minor of minor version number changes over the previous ACF version: 6.3.6.2. https://wordpress.org/plugins/advanced-custom-fields/advanced/ https://wordpress.org/plugins/advanced-custom-fields/advance... (scroll down to the bottom and you can download the previous version to diff it) So as far as the poor benighted plugin updater is concerned, it's just a change to the display name, which is inconsequential. [0] WP Engine do, ironically, on a pretty short timescale!
n3storm 2y ago
pass the bill to matt when you finish fixing those broken wp.
- znpy 2y ago
  He will reply that go has just “contributed their fair share of man-hours” /s
- photomatt 2y ago
  I don't think anything about our update could cause the issues he describes and we've had no other reports, this is the only claim on the internet, and doesn't include enough technical details to tell if it's an actual bug or not. If it's a bug, our bad and we'll fix ASAP. If it's a bug, it's a very rare one. There have been 225k downloads of the SCF plugin in the past 24 hours, implying a lot of updates. I would estimate at least 60% of the sites with auto-upgrade on and using .org for updates have done so already. https://wordpress.org/plugins/advanced-custom-fields/advanced/ https://wordpress.org/plugins/advanced-custom-fields/advance... That said, I'm happy to pay system2 whatever he thinks his time was "spent" on a Sunday is worth. Just let me know an amount and where to send. You can contact me here: https://ma.tt/contact/ https://ma.tt/contact/ .
  - throw16180339 2y ago
    > I don't think anything about our update could cause the issues he describes and we've had no other reports, this is the only claim on the internet, and doesn't include enough technical details to tell if it's an actual bug or not. Don't gaslight us. You've been removing negative reviews.
  - hashim-warren 2y ago
    Matt, you say that you've had no other reports and this is the only claim on the Internet. That's not true. You have users on the support forums reporting issues with SCF. "this has caused an incident requiring unschedule maintenance on a weekend. I use this plugin on a couple hundred sites I help maintain, so this has been a very bad experience " https://wordpress.org/support/topic/plugin-hijacked-on-weekend-required-update-triage/ https://wordpress.org/support/topic/plugin-hijacked-on-weeke...
Atotalnoob 2y ago
Photomatt aka Matt mullenweg hangs out on HN. I’d love to hear how he justifies taking away this engineers’ Sunday? I doubt this person is the only person working this weekend due to Matt’s theft of ACF
- usea 2y ago
  > I’d love to hear how he justifies taking away this engineers’ Sunday? His posts on slack [1] show that he sees it as "either with us or against us", and he's willing to harm users to force them to choose a side instead of staying neutral. He probably hopes that people will blame WP Engine for it. I think his real goal is tortious interference. Hurting devs who use ACF is just a bonus. [1] https://threadreaderapp.com/thread/1843963052183433331.html https://threadreaderapp.com/thread/1843963052183433331.html
luckylion 2y ago
> it broke our snippets because we are using prepend and append texts to wrap our field values Did they also rename filters and functions? I thought it was only the name and mentions of ACF in the docs. What did you rely on?
- system2 2y ago
  We use ACF with WP Code auto insert. ACF has prepend and append (in presentation tab) and this can be used to wrap the value with classes or other tags such as IDs, JS or others. When the ACF name changed, the prepend and append broke because prepend/append text showing must be configured in functions.php like this: add_filter('acf/format_value/name=mysnippet1', 'mysnippet1acf', 20, 3); function mysnippet1acf ($value, $post_id, $field) { if(!empty($value)){ $value = trim($field['prepend'].''.$value.''.$field['append']); }else{ $value=''; } return $value; } Long story short, if you are using ACF with advanced features, including logic and presentation, this hostile takeover breaks it. Doesn't even matter if you use prepend/append for the fields, our logic-based ACF fields are also broken.
  - luckylion 2y ago
    Right, but why did that break? As far as I can tell that part hasn't been touched in the hostile takeover. https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field.php https://plugins.trac.wordpress.org/browser/advanced-custom-f... It's still $this->add_field_filter( 'acf/format_value', array( $this, 'format_value' ), 10, 4 ); The file was last changed 7 weeks ago by deliciousbrains/wpengine and specifically the filter part is the same on their github.
    - system2 2y ago
      Whatever they did, it didn't work. Maybe we are over-custimizing it but it is not unheard of to use ACF with multiple other plugins such as WP Code and custom scripts.
      - 2y ago
deleted 2y ago
[deleted]
jnd10 2y ago
Install the official free plugin from the advanced custom fields website and remove the SCF version. You won’t need to change any existing code then, and future updates will come from the plugin dev for ACF.
- system2 2y ago
  That's where the Sunday goes. I am trying to create an FTP script to mass update all wp-content plugins for this single package. It was on my mind but I was not expecting to have something bizarre happening from WordPress for one of the most crucial plugins in WordPress' existence.
  - mpol 2y ago
    Have you ever looked into wp-cli? It was made for this kind of task.
    - system2 2y ago
      We use the wp-cli with cron jobs such as indexing when we post with API or database-related things. Even with wp-cli we must login to SSH individually. And this doesn't give us the wp-cli option since it is 3rd party zip file. We possibly can get the file, extract, and delete the old plugin with cli, and then enable the last updated plugin with with cli again with a script. Either way, we must create a script or suck it up, go into each wp individually, and take care of it from the backend...
      - WesolyKubeczek 2y ago
        For the future — this use case screams "Ansible!"
      - mldevv 2y ago
        As an agency dev, this is the shit they don't think about. In my case, all that would have to be billed or go through pro-bono approval process. "Just update it!" Until it all goes to shit, and we have to triage the whole mess. Sorry you are dealing with this, I have spent the better part of the weekend trying to get them to understand this was inevitable. Devs: "Don't deploy on Fridays" A8C/Matt: "We will deploy on SATURDAYS"
mldevv 2y ago
(community member, not affiliated with WP, WPE, or A8C) I can confirm this has been escalated internally in the WP slack. I can also provide this context which I found concerning, given the way this was taken over and rolled out on a Saturday afternoon, of which I have also been dragged into now as a fellow site maintainer. - Matt Mullenweg "in a few days we'll have a Github where people can get involved, and we can also set up proper build systems, etc" So its all in flux obviously. I let them know the same thing, that I find this as a malicious supply chain attack that is affecting the community.
mfischface 2y ago
Can't wait for Matt to jump in and blame this on you.
foosantos 2y ago
I've been monitoring the SCF forums as well on WPorg, and there have been no reports of issues since moving to SCF. It would be fantastic if people could open a topic there or a thread on Slack if they face any issues.
- throw16180339 2y ago
  Matt is removing negative comments and reviews.
- DanielLestrange 2y ago
  Are you being sarcastic or a jerk? No issues? At least 50 deleted reviews spoke for themselves! Yeah, you didn’t produce any “technical” issues other than now maintaining a plugin that isn’t yours to start with, gathering thousands of positive reviews that aren’t yours, and selling it as a security fix which you didn’t fix. I don’t understand how you can even show your face in public. You and your fellow matticians are a shame to the entire open source community.
- foosantos 2y ago
  https://wordpress.org/support/plugin/advanced-custom-fields/ https://wordpress.org/support/plugin/advanced-custom-fields/
- tone 2y ago
  No one should risk an unknown entity taking illegal control of a key plugin on their site. I can't imagine anyone wanting WP.org to weaponize more plugins on their site. Update ACF and stay secure against this latest threat. https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ https://www.advancedcustomfields.com/blog/installing-and-upg...
hadad 2y ago
PLugin theft FAFO moment, doing bad QAs, what a joke

gg-plz 2y ago

As someone who doesn’t use it, were those features removed into the patch? If they’re actively breaking people’s sites I’d hope they can get an emergency injunction ASAP, and maybe someone can start a CFAA investigation.

yawnxyz 2y ago

this is my nightmare

btown 2y ago

This should be the top comment. It's already scary for a package manager to take control of a community package, even more so when sites auto-update to new code... but to break existing sites by completely changing the code that is provided in an auto-update is beyond the pale. Not a lawyer, but I imagine many consultancies will be talking to lawyers about this one; there are entire sections of law about interfering with other companies' contracts with each other. At minimum it's an appalling breach of trust.

didgeoridoo 2y ago
“Advanced Tortious Interference”
- sharphall 2y ago
  "Secure Tortious Interference"

Cyberdog 2y ago

How did the sites auto-update to have this plug-in removed/replaced? Are your sites set up to just automatically take push updates from WordPress central command or something and auto-modify themselves?!

sgdfhijfgsdfgds 2y ago
Wordpress has a (highly effective) auto-updates mechanism for security patches. It was extended a couple of years ago to automatically apply plugin updates for you if you opted in, and I think automatic plugin updates may now be the default. (This is on balance a good thing; almost all WP vulnerabilities are outdated plugins, and until this mechanism was prevalent, WordPress occasionally had to live-patch existing installations of third party plugins in the case of severe vulnerabilities.) The reason this nasty little takeover worked is that they (Matt, whoever helped) have stolen ACF's slug (advanced-custom-fields). So as far as the updater is concerned, it's just another plugin update to the same code base. And in fact, very little has changed.
- arielcostas 2y ago
  IDK if WordPress plugins respect SEMVER, but shouldn't this auto-update thingy update only patch versions, or minor versions at most? Idk, breaking changes like these is definitely not something you want your CMS to do overnight when you won't notice until you receive complaints that your site is broken
  - sgdfhijfgsdfgds 2y ago
    Yeah. I don't know off-hand what the rule is for plugin updates, actually; I'd have to look it up. As far as WordPress itself is concerned, the updater definitely does not auto-push updates to major WP versions by default [0], and they continue to patch older versions for a long time. But at any rate, whether the plugin updates respect SEMVER or not, Matt/WP.org pushed this bullshit out as the most minor of minor version number changes over the previous ACF version: 6.3.6.2. https://wordpress.org/plugins/advanced-custom-fields/advanced/ https://wordpress.org/plugins/advanced-custom-fields/advance... (scroll down to the bottom and you can download the previous version to diff it) So as far as the poor benighted plugin updater is concerned, it's just a change to the display name, which is inconsequential. [0] WP Engine do, ironically, on a pretty short timescale!

n3storm 2y ago

pass the bill to matt when you finish fixing those broken wp.

znpy 2y ago
He will reply that go has just “contributed their fair share of man-hours” /s
photomatt 2y ago
I don't think anything about our update could cause the issues he describes and we've had no other reports, this is the only claim on the internet, and doesn't include enough technical details to tell if it's an actual bug or not. If it's a bug, our bad and we'll fix ASAP. If it's a bug, it's a very rare one. There have been 225k downloads of the SCF plugin in the past 24 hours, implying a lot of updates. I would estimate at least 60% of the sites with auto-upgrade on and using .org for updates have done so already. https://wordpress.org/plugins/advanced-custom-fields/advanced/ https://wordpress.org/plugins/advanced-custom-fields/advance... That said, I'm happy to pay system2 whatever he thinks his time was "spent" on a Sunday is worth. Just let me know an amount and where to send. You can contact me here: https://ma.tt/contact/ https://ma.tt/contact/ .
- throw16180339 2y ago
  > I don't think anything about our update could cause the issues he describes and we've had no other reports, this is the only claim on the internet, and doesn't include enough technical details to tell if it's an actual bug or not. Don't gaslight us. You've been removing negative reviews.
- hashim-warren 2y ago
  Matt, you say that you've had no other reports and this is the only claim on the Internet. That's not true. You have users on the support forums reporting issues with SCF. "this has caused an incident requiring unschedule maintenance on a weekend. I use this plugin on a couple hundred sites I help maintain, so this has been a very bad experience " https://wordpress.org/support/topic/plugin-hijacked-on-weekend-required-update-triage/ https://wordpress.org/support/topic/plugin-hijacked-on-weeke...

Atotalnoob 2y ago

Photomatt aka Matt mullenweg hangs out on HN. I’d love to hear how he justifies taking away this engineers’ Sunday? I doubt this person is the only person working this weekend due to Matt’s theft of ACF

usea 2y ago
> I’d love to hear how he justifies taking away this engineers’ Sunday? His posts on slack [1] show that he sees it as "either with us or against us", and he's willing to harm users to force them to choose a side instead of staying neutral. He probably hopes that people will blame WP Engine for it. I think his real goal is tortious interference. Hurting devs who use ACF is just a bonus. [1] https://threadreaderapp.com/thread/1843963052183433331.html https://threadreaderapp.com/thread/1843963052183433331.html

luckylion 2y ago

> it broke our snippets because we are using prepend and append texts to wrap our field values Did they also rename filters and functions? I thought it was only the name and mentions of ACF in the docs. What did you rely on?

system2 2y ago
We use ACF with WP Code auto insert. ACF has prepend and append (in presentation tab) and this can be used to wrap the value with classes or other tags such as IDs, JS or others. When the ACF name changed, the prepend and append broke because prepend/append text showing must be configured in functions.php like this: add_filter('acf/format_value/name=mysnippet1', 'mysnippet1acf', 20, 3); function mysnippet1acf ($value, $post_id, $field) { if(!empty($value)){ $value = trim($field['prepend'].''.$value.''.$field['append']); }else{ $value=''; } return $value; } Long story short, if you are using ACF with advanced features, including logic and presentation, this hostile takeover breaks it. Doesn't even matter if you use prepend/append for the fields, our logic-based ACF fields are also broken.
- luckylion 2y ago
  Right, but why did that break? As far as I can tell that part hasn't been touched in the hostile takeover. https://plugins.trac.wordpress.org/browser/advanced-custom-fields/trunk/includes/fields/class-acf-field.php https://plugins.trac.wordpress.org/browser/advanced-custom-f... It's still $this->add_field_filter( 'acf/format_value', array( $this, 'format_value' ), 10, 4 ); The file was last changed 7 weeks ago by deliciousbrains/wpengine and specifically the filter part is the same on their github.
  - system2 2y ago
    Whatever they did, it didn't work. Maybe we are over-custimizing it but it is not unheard of to use ACF with multiple other plugins such as WP Code and custom scripts.
    - 2y ago

deleted 2y ago

[deleted]

jnd10 2y ago

Install the official free plugin from the advanced custom fields website and remove the SCF version. You won’t need to change any existing code then, and future updates will come from the plugin dev for ACF.

system2 2y ago
That's where the Sunday goes. I am trying to create an FTP script to mass update all wp-content plugins for this single package. It was on my mind but I was not expecting to have something bizarre happening from WordPress for one of the most crucial plugins in WordPress' existence.
- mpol 2y ago
  Have you ever looked into wp-cli? It was made for this kind of task.
  - system2 2y ago
    We use the wp-cli with cron jobs such as indexing when we post with API or database-related things. Even with wp-cli we must login to SSH individually. And this doesn't give us the wp-cli option since it is 3rd party zip file. We possibly can get the file, extract, and delete the old plugin with cli, and then enable the last updated plugin with with cli again with a script. Either way, we must create a script or suck it up, go into each wp individually, and take care of it from the backend...
    - WesolyKubeczek 2y ago
      For the future — this use case screams "Ansible!"
    - mldevv 2y ago
      As an agency dev, this is the shit they don't think about. In my case, all that would have to be billed or go through pro-bono approval process. "Just update it!" Until it all goes to shit, and we have to triage the whole mess. Sorry you are dealing with this, I have spent the better part of the weekend trying to get them to understand this was inevitable. Devs: "Don't deploy on Fridays" A8C/Matt: "We will deploy on SATURDAYS"

mldevv 2y ago

(community member, not affiliated with WP, WPE, or A8C) I can confirm this has been escalated internally in the WP slack. I can also provide this context which I found concerning, given the way this was taken over and rolled out on a Saturday afternoon, of which I have also been dragged into now as a fellow site maintainer. - Matt Mullenweg "in a few days we'll have a Github where people can get involved, and we can also set up proper build systems, etc" So its all in flux obviously. I let them know the same thing, that I find this as a malicious supply chain attack that is affecting the community.

mfischface 2y ago

Can't wait for Matt to jump in and blame this on you.

foosantos 2y ago

I've been monitoring the SCF forums as well on WPorg, and there have been no reports of issues since moving to SCF. It would be fantastic if people could open a topic there or a thread on Slack if they face any issues.

throw16180339 2y ago
Matt is removing negative comments and reviews.
DanielLestrange 2y ago
Are you being sarcastic or a jerk? No issues? At least 50 deleted reviews spoke for themselves! Yeah, you didn’t produce any “technical” issues other than now maintaining a plugin that isn’t yours to start with, gathering thousands of positive reviews that aren’t yours, and selling it as a security fix which you didn’t fix. I don’t understand how you can even show your face in public. You and your fellow matticians are a shame to the entire open source community.
foosantos 2y ago
https://wordpress.org/support/plugin/advanced-custom-fields/ https://wordpress.org/support/plugin/advanced-custom-fields/
tone 2y ago
No one should risk an unknown entity taking illegal control of a key plugin on their site. I can't imagine anyone wanting WP.org to weaponize more plugins on their site. Update ACF and stay secure against this latest threat. https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/ https://www.advancedcustomfields.com/blog/installing-and-upg...

hadad 2y ago

PLugin theft FAFO moment, doing bad QAs, what a joke