Sigh: Apache.org hacked.

Quote:

---

apache.org was down this morning and reports are that one of their servers has been compromised due to an SSH key being exposed. The SSH key was used by an account to perform backups. No vulnerabilities in apache or ssh software was used in this attack. When the incident was identified apache cut access to all of their services as a containment measure. Their web sites are now back online.

---

http://blogs.apache.org/infra/entry/...initial_report

Quote:

---

The attackers created several files in the directory containing files for www.apache.org, including several CGI scripts. These files were then rsynced to our production webservers by automated processes. At about 07:00 on August 28 2009 the attackers accessed these CGI scripts over HTTP, which spawned processes on our production web services.

---

Looks like it was fault of the company responsible for maintaining backups...