Looks like there is a bit of crisis in WordPress house. Hackers gained root access to several WordPress.com servers as well as the VIP blogs hosted by WordPress like TechCrunch, CNN Blogs, TED Blogs, etc. The root access permits users to access each and every file stored on the system and that includes source code of blogs hosted by WordPress VIP hosting.
WordPress issued a public statement about the security compromise today and also alerted all it’s VIP customers in an email (via TechCrunch)
Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed.
We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners’ code. Beyond that, however, it appears information disclosed was limited.
WordPress is investigating the matter and trying to assess the damage caused by hackers. If your blog is hosted on WordPress.com or through WordPress’s VIP hosting, it’s time to change the passwords, private security keys.