WordPresz

It seems there has been an attempt recently to distribute a trojaned version of WordPress via some form of phishing scam.  It seems this attack relied on exploiting an old version of WordPress which had not been upgraded and changing it to point at a different site for one of the dashboard feeds.  The site was then offering a trojaned install of a version of WordPress 2.6.4 which does not exist.  The site has now been shutdown so it is nolonger possible to get hold of this Trojaned version but it does highlight the importance of upgrading when a security release is made.

As I have said in my response in the article on The Register

We recommend that people upgrade as soon as possible when we release a security release so as to ensure they are not vulnerable to issues which will likely have exploits in the wild. Also in the upcoming 2.7 release of WordPress we are including a built-in upgrade mechanism within WordPress which will allow people to upgrade automatically with ease.

I would however stress the need with any piece of software to check that an upgrade is real by visiting the website of the software provider manually rather than relying on a link that you have been provided. Otherwise, as with bank phishing scams there is the potential for someone to trick you into doing something you didn’t want to do.