If you use Word­Press for blog­ging, you should make absolutely sure you’ve upgraded to the lat­est version.

Go do it now. I’ll wait.

I men­tion this because the Not An Employee blog [offline for the moment] was recently dis­cov­ered to have been com­pro­mised. We’re still doing surgery on the blog itself, since there seems to be a vari­ant of the exploit float­ing around that we’re try­ing to iden­tify and contain.

Hav­ing spent much of the week­end read­ing through accounts of the exploit’s signs and symp­toms, what we find in this case seems to be be unique. Or at least unrecorded elsewhere:

1. Three files present in the Word­Press blog folder’s root that we didn’t put there:
   1. css.txt, which is base-​​64 encoded
   2. docbook.txt, also base-​​64 encoded
   3. A file called Usage, which looks like a wget log­file that cul­mi­nates in a suc­cess­ful down­load of docbook.txt from http://​mdasla​.org/​h​e​l​p​/​c​ss/
2. No extra javascript or URLs were found in any of the other files in the install
3. We’re still check­ing the data­base to see if any­thing was touched there

I haven’t seen this one before. The cur­rent wave of Word­Press exploits seem to involve URL mod­i­fi­ca­tions. Any insights? Any more infor­ma­tion needed?