The WordPress team released WordPress 2.6.5 earlier today. This release addresses a potential XSS (cross-site scripting) attack under some server configurations, plus adds some bugfixes for some other minor issues. As noted in the official announcement, there was no official 2.6.4 release. There was an attempt to fool people into downloading a fake release under that number, so it has been skipped in the official release numbering, to avoid confusion.
I would like to take this opportunity to point out the WordPress project entry on Freshmeat. [...]
Checking Your WordPress Security
You may have already heard that sites running out-of-date versions of WordPress have been under attack (Lorelle, Weblog Tools Collection, WordPress Dev Blog). Of course, sites running the latest version of the software seem to be safe, which once again takes us back to what I said over a year ago: Upgrade or else! I haven’t seen complete details yet about how this new worm works, but reports say that part of the hack is to create a new Administrator level account, and then try to hide the existence of that account (via javascript) when you view your list of users.
If you want a sure-fire way to make sure there are no “extra” administrator accounts registered in your blog, I suggest going straight to the source: your MySQL database. [...]