Hacker Gains Access To WordPress.com Servers, Source Code Exposed
WordPress.com has revealed that someone has gained access to several of the their servers this morning and that VIP customers' source code was accessible. WordPress.com customers are all on ‘code red’ and in the process …
Context & Ripple Effects
This is the second time in under two years that WordPress has been publicly burned by an intrusion. In September 2009, Robert Scoble wrote that he didn't feel safe on the platform after hackers broke into his setup and took data (his account of that break-in captured the trust problem early). Today's disclosure escalates from a user-level compromise to Automattic's own infrastructure: several WordPress.com servers were accessed this morning, and source code belonging to VIP customers was reachable.
That last detail is what makes this more than routine incident news. WordPress.com runs a multi-tenant service where paying VIP customers — typically organizations with custom code on the platform — share infrastructure with everyone else. A breach that reaches their source code turns one provider's perimeter failure into a potential exposure event for every VIP tenant at once.
First-order effects
- Automattic has placed all of WordPress.com on 'code red', meaning engineering effort shifts immediately from product work to forensics, containment, and auditing what the intruder touched on the affected servers.
- VIP customers whose source code was accessible now face an unplanned review of what secrets sat inside that code — API keys, credentials, proprietary logic — and whether anything needs rotating or disclosing.
Second-order effects
- Enterprise buyers weighing WordPress.com VIP against self-hosting or competing managed platforms get fresh ammunition for demanding stronger isolation guarantees between tenants, and providers will face pressure to show how customer code is segregated on shared servers.
- The 2009 Scoble episode showed individual users defecting over trust; a server-level breach reaching paying customers' code raises the stakes from blog downtime to contractual and reputational exposure for Automattic's highest-revenue tier.
Third-order effects
- If hosted platforms are repeatedly shown to concentrate risk this way, the industry drifts toward treating a provider's server compromise as a supply-chain event for its customers — with security isolation becoming a selling point, and eventually a contract term, in multi-tenant hosting rather than an assumed background property.
The trend: As publishing and business logic migrate onto shared multi-tenant platforms, a single host's intrusion increasingly exposes every customer's proprietary code at once, making provider-side security a first-class purchase criterion rather than an invisible assumption.