New Features
Major new features in this release include a sexy new default theme called Twenty Ten. Theme developers have new APIs that allow them to easily implement custom backgrounds, headers, shortlinks, menus (no more file editing), post types, and taxonomies. (Twenty Ten theme shows all of that off.) Developers and network admins will appreciate the long-awaited merge of MU and WordPress, creating the new multi-site functionality which makes it possible to run one blog or ten million from the same installation. As a user, you will love the new lighter interface, the contextual help on every screen, the 1,217 bug fixes and feature enhancements, bulk updates so you can upgrade 15 plugins at once with a single click, and blah blah blah just watch the video.

The new version comes with over 500 bug fixes, changes and enhancements which makes it a recommended download and install. Some of the new features include:

• Trashbin: Posts that are deleted are now moved to the trash instead of being deleted irrecoverably. It is possible to recover posts from the trash at a later time.
• Image Editor: A basic image editor that can be used to edit, rotate, scale and crop images.
• Batch plugin support: Update up to ten plugins at once.
• Video Embeds: video embeds for popular sites have become just a tad easier as it is now possible to simply paste the url into the post which will be turned into an appropriate viewer by WordPress automatically.
• Automatic database optimization which can be enabled by adding define(‘WP_ALLOW_REPAIR’, true); to the WordPress config file.
• Post Thumbnails options which can be used to display thumbnails in every post if the theme supports it.
• Better SEO thanks to rel=canonical.
• Custom galleries with the ability to add pictures from several posts.

If you’ve been waiting for your moment to pitch in, it’s now. First we need tech savvy testers to upgrade their blogs and kick the tires, make sure everything is rolling like you expect it to. Here’s a list of all the fun and geeky new stuff in 2.9 to try out. Second, and more importantly, we need everyone to test out their plugin compatibility.

If you’re a user of plugins, there’s a groovy new compatibility feature on the plugin directory where you can vote on whether a plugin is compatible with a version or not and it’ll get registered in the new plugin compatibility checker. This is as a replacement to the old wiki-based lists we’d do before. To see it in action check out this Akismet plugin page, as you can see 14 people have already registered that it’s compatible with 2.9.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.  The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

• A fix for the Trackback Denial-of-Service attack that is currently being seen.
• Removal of areas within the code where php code in variables was evaluated.
• Switched the file upload functionality to be whitelisted for all users including Admins.
• Retiring of the two importers of Tag data from old plugins.

You can get all the details here from WordPress.Org.