WordPress is a complex web application that comprises more than 200 .php files. When you open any page, WordPress loads index.php which, in turn, loads many other .php files using the require() function. WordPress admin interface also relies on multiple .php files. In all cases, WordPress loads wp-config.php file which contains database credentials and other important information required for normal operation.

So what happens if both index.php and wp-config.php are infected with the gumblar backdoor scripts? Since Gumblar injects identical backdoor scripts into files on the same site, they’ll have declarations of identically named functions, which PHP doesn’t allow. Hence the “cannot redeclare zsmh() …” error.

One thing not mentioned in the Unmasked Parasites post is information regarding which specific versions of WordPress are at risk or are safe to use. I’ve left a comment on the blog post to try and get an answer but until then, Denis Sinegubko provides detection and removal instructions while also suggesting the use of the WordPress Exploit Scanner which scans for WordPress files for signs of suspicious activity.

Based on the reports of infection, this does not appear to be a WordPress centric issue pointing to a problem with the software.

It’s been just over a week since WordPress for iPhone 2 was released on the App Store. In that time, you’ve downloaded the app onto over 20,000 iPhones and iPods. We’re really pleased to see how many people are interested in the app, especially those who are able to use it for the first time with version 2.0. To mark the occasion, we wanted to show you our new video introduction for the app, take the time to share some data with you, and answer a few questions we’ve been seeing.

We’re also keeping track of downloads by country and by iPhone OS version. This helps us identify the languages to focus on once we begin translating the app, and helps us plan for which new OS features we can count on our users having available.

As happy as we are with the reception for 2.0, we continue working hard to make it even better. We’ve identified a few recurring questions that we’d like to answer for everyone.

Q. Why is this a new app? I don’t want to re-enter my blog settings.
A. Previous versions of WordPress for iPhone were uploaded to the App Store by a contracted developer. To make it easier for us to test new features, fix bugs, and update the app more often, that task will now be handled by those of us developing the app at Automattic. Apple’s only method for changing the “ownership” of an app in the store is to release a completely new version, as we’ve done here. It’s a bit painful, we know, but we should be set now for all future releases.

Q. Why did you remove landscape mode?
A. It’s still there. Bring up the on-screen keyboard to start editing a post, then rotate the device. Apple doesn’t support landscape mode in some areas, particularly the photo picker and the date selection wheel. Having landscape mode turned on for every section was causing bugs that were impossible to fix (while still using Apple’s standard user interface elements).  So we’ve removed it from the areas of the app where it didn’t work well, and kept it in the writing interface, where it’s really useful.

Q. I can’t log in!
A. Ok, not quite a question, but we’ve seen this one a few times on iTunes. However, we haven’t yet had a report of this in the forums, the only place we’re able to provide hands-on assistance with the app. If you’re sure that you’re entering your URL, username, and password correctly and are still unable to connect, please let us know in the forums. (A quick hint for connection issues: Make sure you’re using the latest version of WordPress, 2.8.5, and try temporarily disabling any plugins you have installed). We’ve done lots of work in version 2.0 to eliminate connection problems for the vast majority of blog setups. We’d like to make it work for everyone, but can only help when you work with us to troubleshoot the problem you’re having.

We’ve already begun working on issues identified since the release of 2.0, and are looking forward to being able to provide more timely updates for you going forward. You can track the progress of the project’s development in Trac.

Once again, if you need help using the app or would just like to offer a suggestion, please visit the WordPress for iPhone forums. You can stay up to date with our progress by visiting our development blog, Making WordPress for iPhone. And of course, if you’re thrilled with the app, we’d love for you to review it on the App Store.

1. Drain Hole
   I’ve been using Drain Hole on my personal site to serve up my files for a couple years now. So far it is the best download manager plugin I’ve been able to find. It does everything it advertises and does it well. I’ve not yet had any issues with this plugin. I highly recommend it!
2. WP-DownloadManager
   Before I found Drain Hole I used WP-DownloadManager exclusively. It did what I wanted and didn’t seem to have many problems. It has the features most would expect in such a plugin. It also has some you might not. Such things as custom templates, categories, RSS feeds, and more.
3. WP-Filebase
   I actually just recently learned of WP-Filebase. I can’t speak from personal experience but from the research I’ve done on it I think it would be one of the best options. It has the obvious features you expect from a download manager. Some of the highlights are quick tags, top downloads widget, extensive file details, and even download pausing.
4. Wordpress Download Monitor
   I really like the interface of Wordpress Download Monitor. It’s simple yet complete. It does its job as a download manager and keeps it simple at the same time. Some of the attraction points of this plugin are: simple custom download URLs, custom error pages, download mirrors, and even custom fields for all files.
5. Simple Download Monitor
   What’s great about Simple Download Monitor is right in its name. It’s simple! To quote the author of the plugin “…I wanted to monitor the number of downloads of my files without having to maintain any kind of database or making any special download links. I just wanted to upload a file to a designated directory using FTP, provide a direct link to it and once in a while check the number of downloads“. This plugin also allows advanced logging.

What I think is especially nice is that all these plugins seem to be compatible with the upcoming WordPress 2.9. That means that they are future-proof for at least the foreseeable future. I took time to test each one of these plugins during the writing of this post. But, feel free to let me know if you have experienced anything to the contrary with any of them.

Well, that’s all for now. I hope you enjoyed the post and I hope you might be able to get something useful out of this list.

Do you have a good idea for the next article in the Best-Of series? Drop a comment here or contact us and your idea just might be next in the series!

WordCamp Phoenix is first up, on November 13. I’d planned on attending this one myself before they changed the date (it was originally scheduled for the 7th), but will sadly have to miss it as it conflicts with WordCamp NYC. If you, like me, can’t make it to Phoenix, be sure to check their web site for information on the live stream they’re planning to provide. If it’s anywhere near the quality of the stream from Portland or Seattle earlier this fall, it’ll be just like being there, but without a t-shirt to show for it (and theirs has stripes, so if you’re local, you should go!). My only consolation in missing this WordCamp is that I’ve seen about half of the speakers before. If you’re going, don’t miss the session by John Hawkins on Building a WordPress Plugin; it got me to write my first plugin in Portland! Matt‘ll be there, will you?

WordCamp Victoria is next, on November 14. This is another one I’d love to go to, but can’t because it’s at the same time as New York’s. I would especially have liked to go because it looks like the speakers are all local, and I haven’t seen any of them speak before. Occasionally WordCamps lose a little of the local feeling by focusing on visiting speakers, so it’s nice to see so many Vancouverites on the list. They’ll have a Blogger track and a Technical track running concurrently, so there should a little something for everyone. No word on a live stream, but hopefully they’ll be able to catch some of the presentations on video and post them to WordPress.tv after the event.

WordCamp Bangkok is scheduled for November 15. I have to admit that the first thing that catches my eye on their agenda is “WordPress Band.” I’ve known WordCamps to have people performing songs before, but a whole band? Might be a first. I hope they’ll post the video to WordPress.tv, too.

WordCamp New York City is the same weekend as the previous three, on November 14-15. In the interest of full disclosure, I need to tell you that I’m one of the organizers of WordCamp NYC, so my informative comment about it here may be a little biased. That said, we have over 50 confirmed speakers (both local and visiting), and 2 full days of content in 8 — count ‘em, 8 — tracks. Newbies get a free year of hosting and walked through setting up a WordPress blog in workshop format, while the other tracks have specialized content for Bloggers, CMS Users, Beginning Developers, Advanced Developers, Academic Users, people interested in MU/BuddyPress, and the Open Source Community. Did I mention the theme and plugin contest? Or the awesome shirts? How about the Genius Bar, or the Hacker Room? The additional Unconference sessions? If you’re anywhere near NYC that weekend (and with the Acela, that’s anywhere from Boston to D.C.), you should definitely come. I’ll be there, Matt’ll be there, lead developer Mark Jaquith will be there, lead developer of BuddyPress Andy Peatling will be there, and too many other WordPress luminaries and locals to mention. If we hit 800 registrations by November 12, I’m baking cookies for everyone.

WordCamp Peru will be on November 28 in Lima. I was checking out their topics list, and it looks like they’re planning to cover all the usual topics around blog administration, security, increasing traffic, and integration with social media sites. No speaker list yet, but if you’re in Peru, it looks like this will be a nice gathering of WordPress users, and they’re hoping to have around 100 people attend.

WordCamp Orlando is the last of the year, on December 5. They haven’t published a speaker list or schedule yet, but I know Matt will be there, Mark Jaquith will be there, and I will be there. I know some other awesome core contributors are planning to come, but I don’t want to jinx anything, so if you’re curious, come see for yourself. Plus, Florida in December!

It first started out as a discussion on the WordPress Hackers mailing list concerning the addition of email notifications to the core of WordPress to keep administrators abreast of new versions of WordPress as they were released. The discussion became long winded but a response by Lynne Pope provided one of those why didn’t I think of that moments.

Change the sample data – instead of, “this is a post”, provide some meaningful information. With a link to subscribe to WP-Announce. Make an entry announcing that WP-Announce is being used, so this will show in the dashboard feeds. Bloggers will quickly pick up on this and news of it will spread.

Needless to say, her idea sparked a series of kudos with other suggestions for what to include in the sample data. Then, in a WordPress development chat regarding the topic that was discussed on the hackers mailing list, it was agreed that the best course of action would be to not only revive the WP-Announcements mailing list, but to also change the Hello World! post in WordPress to something more useful. A fellow by the name of Demetris took it upon himself to create a draft of what the sample data should be. The discussion surrounding the change including links to see drafts and revisions were included in ticket number 11008. The ticket has been open for two weeks and in today’s developer chat, Demetris published a link to his draft which you can view here. There was a unanimous decision to include the sample post data into the core of WordPress starting with version 2.9. If the sample data needs editing, it will be done throughout the beta process before the stable release.

There you have it. A time line of events that happened in quick succession which provided a small change with huge benefits without having one line of code written. Let me know your thoughts in the comments with regards to the new sample data that will be provided in any new installation of WordPress starting with 2.9.

Local Time

Using JavaScript, Local Time automatically transforms all dates and times on your blog into the visitor’s timezone.

Fytch Comments

Fytch is a fully featured plugin that provides comment publishing to http://fytch.com It allows to assign a Fytch topic to each post so that wordpress comments are co-published under the appropriate topic on http://fytch.com. It not only allows to publish comments to http://fytch.com but to Twitter and FriendFeed as well.

vlam-a-post

vlam-a-post automatically creates a vl.am URL for every post you publish and keeps track of the number of clicks the vl.am URL received. After publishing your post you can easily post your vl.am URL to twitter.

Amazon Affiliate Linker

The Amazon Affiliate Linker Plugin allows easy linking to Amazon.com products by only using the ASIN (Amazon Standard Identification Number). It also allows you to embed your Amazon Associate link so that you can pick up affiliate commissions on your links.

Facebook Share New

The Facebook Share (new) button easily allows your blog to be shared. The button also provides a current count of how many times your story has been shared throughout Facebook.

Thumblated Related Post

This plugin shows thumblated related posts. It allows you to design your own layout using simple and easy interface.

Random Post Link

Generates a link to random post, but never the same as before.

Gweather

With the gweather plugin you can display and embed Google Weather Feeds in your WordPress posts and pages.

Simple Facebook Connect

Makes it easy to add Facebook Connect functionality to any WordPress site. Modular: activate only the pieces you need.

URL Shortener

Allows you to create your own short url using the WordPress Post ID and also integrates multiple URL Shortening service with your WordPress.org installation bringing a similar functionality to that of WordPress.com’s WP.me shortlinks feature but using 3rd party URL Shorteners.

Page.ly Reseller Management

This plugin is a Reseller dashboard to manage client accounts on the page.ly WordPress hosting system.

Updated Plugins

GD Star Rating

GD Star Rating is post, page and comment rating and review plugin for WordPress. Plugin supports different image sets, rating moderation, vote rules, time restricted voting, templates, trend calculations, multi ratings, templated rendering, has a widgets build in and extensive shortcode support. Plugin can be integrated with comments for making a review website.

Visitor Blogroll

The visitor blogroll is a Wordpress Plugin/Widget which allows visitors to your blog to leave an RSS feed of their blog which is then displayed on your visitor blogroll.

WordBB

WordBB is an integration between the blogging platform WordPress and the bulletin board system MyBB.

Digg This Button

Adds the smarter digg button. Extended options like topics, prefilled descriptions, shortcodes etc. allow full control of your digg icons.

hRecipe

This is a plugin to allow the easy entry of microformat content for recipes (i.e. the hRecipe microformat) in WordPress pages and posts.

Check out the live demo before you download the guide.