Advanced Custom Fields version 6.4.3 is now available. This release contains several security fixes for ACF and ACF PRO, including additional HTML escaping for field group labels, post titles, and Select2 elements to prevent JS vulnerabilities in the WordPress admin. These vulnerabilities all required an ACF admin user to save malicious HTML. For this reason, it’s important to only ever import ACF JSON files from trusted sources.

Roger Montti pulls some highlights from Cloudflare’s report on DDoS attacks.

Supply chain attack found in Gravity Forms. Here are the details as they are unfolding.

A German court ruled that Meta tracking pixels on third party sites violates the GDPR.

It looks like WordFence is following in Patchstack’s footsteps and is now offering a Vulnerability Management service for plugin and theme developers.

If you are still running sites with WordPress 4.1 through 4.6 then take note that security back-ports will no longer be available. Usage of these versions is very low.

FluentAuth is a free login and security plugins. Version 2.0 of FluentAuth was released yesterday. It included some updates needed by users as well as several new features. Some of the new additions include Login with Facebook, Login/Register Page Customizer, and the option to log via email as a primary option. Md Shahjahan recorded a video about the new version.

Is WordPress core not being secure just a perception issue, or is there more that needs to be done?

This is a good discussion about WordPress security with Mario Peshev and Oliver Sild. It is a wide-ranging discussion.