Contrary to the default configuration, auto-updates are disabled for WordPress instances managed by SaaS Web. This is because we at SaaS Web take management seriously; nothing should happen automatically without our intervention…
This configuration line can be added to the wp-config.php file:
define( 'AUTOMATIC_UPDATER_DISABLED', true );
Here is the original report about the error, which has since been fixed:
https://www.wordfence.com/blog/2016/11/hacking-27-web-via-wordpress-auto-update/
Alternatively, here is the Heise report:
http://www.heise.de/newsticker/meldung/Kardinalfehler-im-WordPress-Update-Server-27-Prozent-aller-Webseiten-sollen-gefaehrdet-gewesen-sein-3496780.html
