Some of our WordPress instances were exploited yesterday at 11 AM UTC. We noticed that the compromise had taken place today and took the blogs offline as soon as we noticed. We have since restored the WordPress files from backup* to a new set of servers. Using our logs we were able to identify the exploit used as a vulnerability in timthumb.php which was included in a theme installed on our wordpress instances and we have removed the theme.
What does this mean to you as a user? If you have an account on one of our blogs then your password has been reset. However, if you have used the same password on other sites then you should also reset that password on those sites.
We apologize for this inconvenience and breach of trust. We will be using more rigorous security procedures around our blog network going forward.
*The database backups were failing but we did have a backup of all the files. We manually combed over the database to find any signs of damage but were unable to find any.