archGFX

If you run a wordpress blog, you should be reading Blogsecurity. This is the feed I use, that only includes the wordpress advisories. I think it's a damn shame that this feed isn't included in the wordpress planet that's syndicated across everyone's dashboard. Security is far more important than wordcamp.

I'm only bringing this up because there's a new Wordpress 2.3.3 exploit that's as-yet unpatched. So far it seems to only affect blogs with open registration, but no one's yet sure what exploit is being targetted. So far the only stopgap solution is to create a directory in wp-content/ called 1/, and set the permissions to 000, using an FTP program:

While you're in there, you should also make sure your wp-content/ directory is set to 755, and you should set wp-content/index.php to 444, since the exploit seems to replace that file as well.