ZDNet warns of a worm that is circulating that can post malware and spam to some WordPress blogs using older versions of the software. If you use WordPress, make sure you update to the latest version:

The worm can be tough to catch, as Mullenweg explains: "it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts."

if you are lazy to upgrade, here's a workaround:

Basically, all you need to do is replace some text in your wp-login.php
file. Just go in there and change:


[code:1:32d73ca6dc]

if ( empty( $key ) )

[/code:1:32d73ca6dc]

to

[code:1:32d73ca6dc]

if ( empty( $key ) || is_array( $key ) )
[/code:1:32d73ca6dc]

Now if someone tries to reset your password using this exploit,
they will get slapped down with the message
"Sorry, that key does not appear to be valid."