Open Door Found; Closed

Aargh.

The problem wasn't in Movable Type at all; it was in phpBB, as in the old mu.nu forums. A combination of a hole in phpBB, the design of Movable Type, and an oversight on my part allowed the hackers to deface your pages.

I've shut down the mu.nu forums. Completely. I've had too many problems with phpBB 2, and version 3 still isn't out. phpBB can be kept reasonably secure if you attend to it regularly, but I have too many things to look after to worry about something with as bad a history as this.

The hackers managed to run some other scripts as well as the one that defaced your blogs. They never had administrator access, but it's possible they made a mess in some places I haven't found yet, so I get to spend the next day or three crawling all over the system and zapping anything that looks suspicious. This *has* to be done before we can move to the new server, so I might have to put that off for another week.

Fortunately, none of this affects Minx, which is on completely separate dedicated servers, and isn't affected by the same sort of security loophole. (Which is not to claim that it's immune to attack, but it's immune to that attack.)

Sigh.

At least now I know what it was, and I can close the door on it. Apologies to everyone affected, particularly George Roper, who ended up (not that this was my intention) almost acting as bait so that the attackers would come back and I could catch them in the act.