Reuters was using old WordPress version when it was hacked

Summary:The Reuters News blogging platform was hacked on Friday and a false interview with a Syrian rebel leader was posted. It turns out Reuters was using an outdated version of WordPress, suggesting the hackers got in by exploiting a known security hole.

 

Reuters was hacked via an old version of WordPress

The Reuters blogging platform was hacked on Friday , and a false story about an alleged interview with a Syrian rebel leader was posted. On Sunday, Reuters suffered a second security breach in which hackers gained control of one of its Twitter accounts . While Twitter hasn't commented on the latter, we have more information on the former: Reuters forgot to keep its WordPress installation updated.

Mark Jaquith, one of the WordPress platform lead developers and member of the WordPress Security Team, told the WSJ that Reuters was using "an old version" of the software that has "publicly known security issues." More specifically, the publication was using version 3.1.1. The current version is 3.4.1.

This is a textbook mistake. You should always be using the latest version of your software, especially if you're a major company that is often targeted by hackers. WordPress is, in particular, a popular attack vector for cyber criminals. While there is no guarantee that the hackers exploited an unpatched security hole in WordPress to access Reuters' blogging platform, it's more likely given this new information.

If you're not using the latest version of WordPress, you should upgrade immediately. You can download the new version from wordpress.org/download or from your Dashboard (Updates menu in your site's admin area).

While Reuters confirmed the hack on the weekend, the firm said it does not yet have any information on the party responsible for the fake news. The publication took down its blogging platform on Friday but a quick check shows that blogs.reuters.com is now working as expected. For their sake, I hope the engineers who brought it back made a point to upgrade their WordPress installation.

Correction - Title was changed from "Reuters was hacked via an old version of WordPress" to "Reuters was using old WordPress version when it was hacked."

See also:

Topics: Security, Outage

About

Emil is a freelance journalist writing for CNET and ZDNet. Over the years, he has covered the tech industry for multiple publications, including Ars Technica, Neowin, and TechSpot.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.