According to the latest post, at the time of writing, on the WordPress development blog, a cracker gained access to one of the servers that power wordpress.org and modified the WordPress 2.1.1 distribution package. It is said that malicious code that can make the web application vulnerable was planted into the archive.