« Podiobooks make it in… | Home | Extermination by choc… »

Webloggers be warned: Wordpress v2.1.1 is compromised!

Monday 05 March 2007 at 09:38 am
A recent emergency bulletin from Matt of the Wordpress weblogging software project is highly distressing to say the least: someone cracked one of the project's servers and inserted a pair of backdoors into v2.1.1, which make it possible for a malicious user to remotely execute aribitrary code on the server hosting a Wordpress blog.

What I want to know is this: Why wasn't the Wordpress project at the very least posting hashes of the distribution archives, or PGP/GPG signing the archives and posting detached signatures for the files? Looking at the Wordpress download page shows a pair of buttons for downloading .zip and .tar.gz archives of WP v2.1.2, but nothing that will verify the authenticity and/or integrity of the archives.

Tags: authenticity, backdoor, infosec, integrity, wordpress, wtf

Fight Spam! Click Here!

Trackback link:

No comments recorded.

Name:			Remember personal info? Yes No
Email:
URL:
Comment:		/ Textile
(Register your username / Log in)
Notify: Yes, send me email when someone replies. Hide email: Yes, hide my email address.
Small print: All html tags except <b> and <i> will be removed from your comment. You can make links by just typing the url or mail-address.