In reply to Marcelo.

We host through Codero on a dedicated server so I am really not exposed much to other firms. We have a server at 1&1 and no issues there.

I presume Wordpress is just FTP'n things?

I've not looked at the update code.

This was sorta discussed scant weeks back when the security issues occurred in context of manual .vs. automatic updates.

I am more for a manual update but can certainly understand those not wanting that. I am a .NET coder and would loath the concept of doing Win updates by hand. Kinda funny when ya thing about it. A persons PC is far more at risk than a website security wise yet when it comes to a secure config of say Windows, webmasters will mostly be lost. Lots of ports, lots of manual firewall to configure. Kinda silly yet not, paradoxical. My firewall gets banged at about 1200-1500 times a day. But in all my years only once did I have issue. Was earlier in ASP.NET days. Was coding, went to go on the net and nuthin'. Call Time Warner. Told me my IP had sent out over 12,000 emails. I look and sure as little apples someone crawled in through IIs best I could figure.

I'd be more in favor as noted in another thread of a notification in the Dashboard BIG AND BOLD about anything security update. And if the primary admin even comes in and does most administration from the front getting a security info popup, pop in... pop something.

My only REAL concern as far as interests go is ongoing security. Since as I noted we are using WP in support (CMS support shell as is the plan) around another application done in .NET we dont want see whammy's that bring things spiraling down on the CMS side. The codebase's are completely independent, so the CMS getting hacked would not impact the ASP.NET app in the least. It doesnt even know its there.

Wordpress was the next place to go after Joomla.