I use Wordfence on the affected sites, but not Cloudflare.
I tried disabling Wordfence, but that made no difference.
I run VSFTPD on Jessie, thats why I need FTP to update, so the necessary ftp access information is in wp-config.php.
I noticed that the WP upgrade file is downloaded, extracted and then deleted again (I see the deletion commands in the FTP log) – so it does not seem like extraction is not working.
Owner of webserver created files is www-data – owner of ftp created files is the virtual server owner (username = domainname)
I have noticed that the WP core update works when I do
chmod -R www-data /home/mydomain.com/public_html
run the update (works fine), then
chmod -R mydomain.com /home/mydomain.com/public_html
to get the original permissions again
So as far as I can see it must be some permission problem when using FTP ext instead of direct access, and this was introduced in 4.5 or the version before 4.5
Additional information: I use Virtualmin to manage the server.
That’s my input for now…