Just a quick note for all you folks running WordPress blogs. There is apparently a hack in-the-wild that can lead to a site compromise. There’s no patch as of yet, but it does seem to be “under control” per some of the news I’ve seen.
Regardless, I wiped out 99% of the user accounts in the system as a precaution. Basically any username/mail address I didn’t immediately recognize as legit got the axe. If that included you and you are a human being with eye-holes and whatnot take heart that it was not an intentional slight. Just re-create your account and it’ll be right as rain.
While you’re at it, feel free to post a comment. Or don’t.
I’m very curious as to what the infection vector for this is, as after 48 hours NO ONE seems the have a fucking clue – least of all WordPress. That in and of itself is curious, if a bit frightening. They are rarely at a loss for words when something like this comes up. The silence, as they say, is deafening.
It seems that WordPress is side-stepping the issue today with a general statement on file permissions. The implication is that the host screwed up and it has nothing to do with WP directly. But that doesn’t seem to fit given some of information out there. Are general users safe? Are they not safe? This kind of ambiguity absolutely KILLS me when I encounter it professionally. Accept blame if it’s due and fix the problem OR state emphatically that there is no problem. Either way the steps are easy:
- tell your “customers” what you know