Hackers Behind Tumblr Worm Say They Warned Tumblr of Vulnerability Weeks Ago
Tumblr has been flooded by a worm that's spamming thousands of user's feeds with an anti-Tumblr rant. In an interview, a spokesman for the group that's apparently behind the hack claims they warned Tumblr weeks ago …
Context & Ripple Effects
The worm that flooded thousands of Tumblr feeds on December 3 spread by hijacking the site's own reblogging feature — every logged-in victim became a distributor, which explains how fast it moved (Naked Security's same-day breakdown traces the propagation mechanics). The group behind it told Gawker they had flagged the vulnerability to Tumblr weeks before going public, turning a cleanup story into a disclosure dispute.
The timing compounds a rough stretch for Tumblr's operations team, which has a documented history of availability and trust friction — from past outages (the April 2011 downtime wave) back to the 2009 user revolt over its anonymous-blogger ban. The company also crossed into comScore's Top 50 U.S. web properties this spring at 23.5 million monthly visitors, so the attack hit a platform newly operating at mainstream scale.
First-order effects
- Thousands of Tumblr users saw their dashboards spammed with an anti-Tumblr rant, and Tumblr has been scrubbing the infected pages while racing to patch the reblog vector the worm used.
- The hackers' claim of a warning weeks earlier puts Tumblr on the defensive publicly: if unaddressed, it suggests the company's vulnerability intake failed precisely as its audience scaled.
Second-order effects
- Other reblog-and-repost platforms face pressure to audit the same class of flaw — any feature that executes content from trusted users' accounts is now an obvious worm carrier after this demonstration.
- The disclosure dispute sharpens the standing question for every fast-growing consumer platform about how to handle researchers who report bugs quietly, since Gawker's interview gave the attackers a sympathetic 'we warned them' frame across eight-plus syndicating outlets including CNET, the Guardian, CNNMoney and Mashable.
Third-order effects
- If self-propagating worms through social features keep recurring at scale, platform operators will be pushed toward treating third-party researcher reports as infrastructure rather than PR risk — the alternative is each incident becoming a credibility event like this one.
- For Tumblr specifically, repeated operational stumbles layered on rapid growth feed a longer-running pattern of community distrust dating to 2009, which matters for a service whose value rests entirely on its user base.
The trend: As social blogging platforms scale into the mainstream, self-spreading worms that weaponize native sharing features are becoming the recurring stress test of their security response.