According to the SANS internet Storm Center, it looks like it's most likely exploit for MS05-011, since that was released yesterday. Everyone should be patches against that (right?), so it's less of a concern than if it's -027.