Reuters was using old WordPress version when it was hacked

The Reuters blogging platform was hacked on Friday, and a false story about an alleged interview with a Syrian rebel leader was posted. On Sunday, Reuters suffered a second security breach in which hackers gained control of one of its Twitter accounts. While Twitter hasn't commented on the latter, we have more information on the former: Reuters forgot to keep its WordPress installation updated.

Mark Jaquith, one of the WordPress platform lead developers and member of the WordPress Security Team, told the WSJ that Reuters was using "an old version" of the software that has "publicly known security issues." More specifically, the publication was using version 3.1.1. The current version is 3.4.1.

This is a textbook mistake. You should always be using the latest version of your software, especially if you're a major company that is often targeted by hackers. WordPress is, in particular, a popular attack vector for cyber criminals. While there is no guarantee that the hackers exploited an unpatched security hole in WordPress to access Reuters' blogging platform, it's more likely given this new information.

If you're not using the latest version of WordPress, you should upgrade immediately. You can download the new version from wordpress.org/download or from your Dashboard (Updates menu in your site's admin area).

While Reuters confirmed the hack on the weekend, the firm said it does not yet have any information on the party responsible for the fake news. The publication took down its blogging platform on Friday but a quick check shows that blogs.reuters.com is now working as expected. For their sake, I hope the engineers who brought it back made a point to upgrade their WordPress installation.

Correction - Title was changed from "Reuters was hacked via an old version of WordPress" to "Reuters was using old WordPress version when it was hacked."

See also:

• Syria disconnects itself from the Internet for 40 minutes
• Syria pushing malware via Skype to spy on activists
• Indonesia blocks 1 million porn sites, is just getting started
• Anonymous, hacktivists helped WikiLeaks with 'Syrian Files'
• Iran state TV: The BBC hacked us
• China orders video sites to censor vulgarity, violence, porn