News agency Reuters admitted that its blogging platform has been hacked twice. The latest attack came just 48 hours after a computer intruder was able to post fake news stories on its web site.

In Sunday's attack, a small Reuters Twitter feed - @ReutersTech, with 17,000 followers - was briefly controlled by hackers. The attacks appear to have come from Pro-Syran hackers who are desperate to tell a different story from the one which usually accuses them of massacring people.

But it seems that Reuters bought the attack on itself by not updating its CMS. Marcus Carey at vulnerability management and penetration testing company Rapid7 said that the attack was not particularly surprising, as it seems they were on version 3.1.1 of Wordpress, which could have been patched as early as July 2011. He said that Wordpress was  currently up to version 3.4.1 and it looks like there are twenty different vulnerabilities that have been reported for the older version that Reuters is using.  

Carey pointed out that Wordpress and its plug-ins are often targeted by attackers as the wide proliferation of the software makes it a target that provides a lot of bang for the buck for exploit developers. He said that it was plausible the attackers gained access through one of the known vulnerabilities associated with version 3.1.1 of Wordpress, and then reused the credentials they gained to hack Reuters’ Twitter account.

“We see so many breaches resulting from poor patching practices and organisations really need to take this seriously. Updating the software you use is a basic step in improving your security posture, yet too often we see evidence of a lack of execution in this area,” Carey said.