Another Debian server security breach
According to this story, there has been another compromise of a debian project server. (Is this the third in the last year?)… the Alioth webserver was offline most of the 5th of September…
It was simply stopped because we discovered that some script kiddies were running an IRC proxy. After thorough investigation, we discovered that they exploited a pmwiki security hole[1] to deface some web pages, to install some malicious php pages which in turn were used to setup the IRC proxy.
They DO state that there are too many projects with custom installed web software, which can put them at greater risk. It’s good that they found it and cleaned it up and are giving the public announcement. It should serve as an example for everyone to keep their web applications updated.