Tech Crunch: WordPress.com has revealed that someone has gained access to several of the their servers this morning and that VIP customers’ source code was accessible. WordPress.com customers are all on ‘code red’ and in the process of changing all the passwords/api keys they’ve left in the source code.
“Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed.
We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners’ code. Beyond that, however, it appears information disclosed was limited.”
While Automattic is down playing the leak, site source code includes API keys like Twitter and cookie log-ins which can let interested parties gain access to sensitive information like Twitter accounts.
Automattic says that the investigation “is ongoing.” I’ve contacted Automattic for more information and will update this post when I hear back.
Updated: Follow up: Hacker Gains Access To WordPress.com Servers, Site Source Code Exposed