Zero Day Vulnerability in many WordPress Themes

The BIG news this weeks is the TimThumb.php security issue that if left unsolved can allow a hacker to run malicious code on your website.

A lot of WordPress themes use timthumb (besides the large number on the repository, theme clubs like WooThemes and ElegantThemes also use it) so if you have timthumb on your site, take steps to resolve the issue. The first 3 articles bellow are about this so read about it and stay safe.

News & Articles

Zero Day Vulnerability in many WordPress Themes (markmaunder)
An image resizing utility called timthumb.php is widely used by many WordPress themes. If your WordPress theme is bundled with an unmodified timthumb.php as many commercial and free themes are, then you should immediately either remove it or edit it and set the $allowedSites array to be empty.
Technical Details and Scripts of the WordPress Timthumb.php hack (markmaunder)
If you want to learn more about the timthumb read this article from Mark Maunder, the same guy that reported the hack.
A secure rewrite of timthumb.php as WordThumb (markmaunder)
And this is the latest development from the timthumb.php hacking news. Mark Maunder rewrote timthumb and you can get it from Google Code.
MarketPress Membership Ultimate Facebook Supporter WPMU DEV The US Government’s Federal Register Releases Its WordPress Code and Themes for Free (wpmu)
The Federal Register: The Daily Journal of the United States Government uses WordPress for its blog. Their team has just released an API to make it easier for developers to build new ways of interacting with Federal Register data. Along with the new API, the Federal Register has also open sourced its project source code and you can download it from GitHub.
Behind the Site: The Olive Oil Times (yup, seriously) (wpcandy)
I love the "Behind the Site" section over WP Candy. You can learn about neat tricks and plugins that you wouldn't otherwise think about.
WordPress-based Businesses: Join Us! (2011.sf.wordcamp)
A call to action for small businesses regarding participating to WordCamp San Francisco this year.

Theme News

Post Options API: An Alternative to Custom Fields (theme)
This is just an experiment but definitely something to keep an eye on. It's just a alpha plugin right now but hopefully something like this will make it's way in WordPress 3.4 or 3.5.
Interview: WP Paintbrush Developers, Ryan Hellyer and Dan Milward (wpmu)
WP Paintbrush is a new theme creator and front end editor for WordPress. This is an interview with it's developers, Ryan Hellyer and Dan Milward.
StartBox 2.5.2 Is Out, and FREE! (wpstartbox)
StartBox 2.5.2 has been released and is available for immediate download and it's now 100% free!
6 Trac Tickets Every WordPress Developer Should Follow (theme)
Staying up to date to latest theme development changes is a must for all theme developers. Here's 6 tickets that will probably appear in WordPress 3.3
Niche Showcase: 10 WordPress Themes for Restaurants (wpmu)
A list post with Restaurant themes. Check them out.
Headway Themes Makes a Move to Support BuddyPress (wpmu)
Exciting news from Headway Themes this week is that they have released their much-anticipated BuddyPress add-on.
30 Unusual, Fresh and Creative WordPress Blog Designs 4 (wplift)
Yet another list post. If you're in a creativity blockage this might help out a bit.

Theme Releases

Daily Deal (templatic)	Busby (wplift)	Serenity (studiopress)
Associate (studiopress)	WPpaintbrush (wppaintbrush)	Fliphoto (simplywp)
Sixhours (wordpress)	San Fran (wordpress)	LeanBiz (elegantthemes)
MiniFolio (wpexplorer)	Pekaboo (themeforest)	Pinkalicious (wpsmith)

Plugin News

How To Publish To The WordPress Plugin Repository (wp.tutsplus)
Publishing a plugin over to the WordPress.org repository can be a bit intimidating if you haven't done it before. This is a great articles that every developer that haven't submitted a plugin should read and actually creating and publishing a free plugin just to see how the process works.
Show Shortcode (wordpress)
This lets plugin developers display their shortcodes without executing them and without any special formatting or extra work.
Introducing Foobar For WordPress (themergency)
Foobar is a cool little plugin that adds a bar on top of your site that displays a custom message.
Resource Roundup! 20 Creative Shortcodes To Use In Your Projects (wp.tutsplus)
Take a look at some creative implementations of the Shortcode API.
Introducing BriefCase (presswork.me)
BriefCase is a suite of advanced plugins for PressWork that comes bundled with all of their premium themes. Briefcase adds extra functionality to help you make the most out of PressWork.

Tutorials

WordPress Custom Post Types Get Into The Loop (wpengineer)
This article briefly explains how to get content of Custom Post Types in the loop of WordPress.
Emptying an option created with the Settings API (wordpress.stackexchange)
This StackExchange thread talks about removing Settings Options properly.
How to setup subdomains for a local WordPress network (devpress)
Setting up subdomains on a local server (localhost) needs a little bit of modifications to Apache's config file and the host file. Here's how to do it.
Re-key an Indexed Array of Post Objects by Post ID (wordpress.mfields)
Using the not-so-new WordPress core function wp_list_pluck() to list the array from get_posts() ordered by the post ID. Nice