A blog I had running WordPress 2.6.5 was hacked to include a truckload of pharmaceutical links. That was nothing new. I've seen that on my blogs and on others.
What was different this time, though, was the method for including the links. I won't republish the code, but here are enough of the functions and variables it used for someone to find this post when searching for more information or to determine if their blog was hacked using the same ... Keep reading »
I was reading MindValley Lab's latest post in my feed reader this morning and noticed a set of 19 very spammy links right after the first paragraph:
<div style="left: -2700px; position: absolute; top: -3600px">
<a href="http://www.johnnybrendas.com/wp-content/kamagra/index.html">25mg kamagra</a><br />
<a href="http://www.johnnybrendas.com/wp-content/kamagra/map.html">kamagra</a><br />
<a href="http://www.johnnybrendas.com/wp-content/kamagra/about-kamagra.html">about kamagra</a><br />
<a href="http://www.johnnybrendas.com/wp-content/kamagra/adresse-kamagra-belgique.html">adresse kamagra belgique</a><br />
<a href="http://www.johnnybrendas.com/wp-content/lasix/index.html">12.5mg lasix</a><br />
<a href="http://www.johnnybrendas.com/wp-content/lasix/map.html">lasix</a><br />
<a href="http://www.johnnybrendas.com/wp-content/lasix/200-lasix.html">200 lasix</a><br />
<a href="http://www.johnnybrendas.com/wp-content/propecia/index.html">0 buying propecia</a><br />
<a href="http://www.johnnybrendas.com/wp-content/propecia/map.html">propecia</a><br />
<a href="http://www.johnnybrendas.com/wp-content/propecia/1-4-propecia.html">1 4 propecia</a><br />
<a href="http://www.johnnybrendas.com/wp-content/soma/index.html">0 dreampharmaceuticals online order soma</a><br />
<a href="http://www.johnnybrendas.com/wp-content/soma/map.html">soma</a><br />
<a href="http://www.johnnybrendas.com/wp-content/soma/1-buying-online-soma.html">1 buying online soma</a><br />
<a href="http://www.johnnybrendas.com/wp-content/soma/1-online-soma.html">1 online ... Keep reading »
Looks like John Chow's Technorati 100 blog has been hacked by ISKORPTIX (safe link), and Geek in Paradise is reporting that the hacker has hit several other blogs as well. Looks like it may be a server hack and not a WordPress hack.
Update, 18:05 Eastern: Prompted by Tim in the comments below, I've read back through everything now, and it doesn't look like we know what the problem is at all. I can't believe ... Keep reading »
