Security Email Alerts

maltfield
(@maltfield)

1 month, 1 week ago
How can I subscribe to get critical security (only!) email alerts from WordPress?

A couple months ago, wordpress core fixed a high-severity (9.8/10) security bug which allows an unauthenticated website visitor to perform SQL Injections and achieve arbitrary Remote Code Executions.

Unfortunately, I didn’t learn about this release the day that it was fixed.

How can I get email notifications whenever a new WordPress release is published which patches critical security vulnerabilities?

Note: I do *not* want to signup for a general newsletter nor get an email every time a new version of WordPress is released. I only want to recieve emails when a critical security bug is patched in a new release.

Any answers that include me getting a single email that’s not about a new release of wordpress with patches of critical security vulnerabilities is *not* a valid answer to this question.
- This topic was modified 1 month, 1 week ago by maltfield.
- This topic was modified 1 month, 1 week ago by maltfield.
- This topic was modified 1 month, 1 week ago by maltfield. Reason: fix quotes

Viewing 8 replies - 1 through 8 (of 8 total)

Thread Starter maltfield
(@maltfield)

1 month, 1 week ago

See also:

* https://wordpress.stackexchange.com/questions/433274/security-email-alerts

Fida – WPMU DEV Support
(@fidawpmudev)

1 month, 1 week ago

Hello @maltfield ,

I hope you are doing well.

The WordPress News Security category (feed URL) and the Make.WordPress.org Security blog (feed URL) publish official announcements about vulnerabilities, patches, and end-of-support notices. You can subscribe to these feeds so that you’re always informed.

You can subscribe to RSS feeds by using a dedicated feed reader like Feedly, Inoreader, or NetNewsWire, or a browser extension like the RSS Subscription Extension for Chrome.
You can check this article to learn more: https://www.usecarly.com/blog/how-to-subscribe-to-rss-feed/

Kind Regards,
Fida Al Hasan

Rezwan Shiblu
(@rezwanshiblu1952)

1 month, 1 week ago

There’s no official WordPress mailing list that only sends security alerts, as far as I know.

The closest official source is the security category on the news blog:
https://wordpress.org/news/category/security/

The other thing that actually arrives as email is the auto update notice from your own site. Security fixes ship as minor releases and those auto update by default, so WordPress mails the admin address once it runs.

Moderator threadi
(@threadi)

1 month, 1 week ago

Yes, you can also subscribe to the RSS feed from the URL mentioned above: https://wordpress.org/news/category/security/feed – external tools probably also allow you to set up email notifications for this.
Thread Starter maltfield
(@maltfield)

1 month, 1 week ago
Thanks all. RSS feeds are interesting, but not an email.

Does anyone know of a free service that will email me every time there’s a new entry published to an RSS feed?
- This reply was modified 1 month, 1 week ago by maltfield.
Rezwan Shiblu
(@rezwanshiblu1952)

1 month, 1 week ago
Blogtrottr does exactly that. Paste the feed URL, choose real time delivery, and it emails you each new item – https://blogtrottr.com

Feedrabbit is the same idea but it caps the number of feeds: https://feedrabbit.com

If you would rather not depend on a third party, rss2email is a small Python tool you can run from cron on your own box: https://github.com/rss2email/rss2email

Either way, point it at https://wordpress.org/news/category/security/feed/ . That category is low volume, so you should only hear from it when something security related is actually published.
- This reply was modified 1 month, 1 week ago by Rezwan Shiblu.
jacobel05
(@jacobel05)

1 month, 1 week ago

Along with the official WordPress Security News feed, it might be worth setting up RSS or email alerts from vulnerability databases like WPScan or the CVE database. The official WordPress blog can sometimes take a bit to post about security releases, whereas vulnerability DBs tend to log critical CVEs (like 9.8s) almost immediately after the patch drops.

Rezwan Shiblu
(@rezwanshiblu1952)

1 month ago

Core security fixes get announced on the news blog the same day the release goes out, so that feed isn’t sitting behind the patch. 6.8.3 is a decent example, released and posted on September 30.

The vulnerability databases also track plugin and theme issues, and that’s most of what lands in them, so there’d be a lot to sort through before you hit anything about a core release.