This last comment got me curious - how many of those who have commented here actually got hacked by this latest worm? None of the sites I manage were. Logs showed plenty of attempts, even on the 2.6.5 sites, but all attempts to date came to nothing. WordPress Tavern wasn't hit. Was anyone hit or are we all just discussing ways in which securing WordPress could be easier?