Awesome comments and advice. My co-workers are working on this.

WordPress.com team is investigating the issue. They have disabled the vector while they continue to investigate.

Do you work on the Wordpress.com team? No info in your profile.

Yes. Updated my profile, but don't believe what you read on the interwebs ;-)

Ha! Funny as always.

Too bad there is no way of verifying you are really lloyd.

Seems like we could come up with something - even if it only works for techies.

You mean like foaf+ssl?

Is it a general bug in WordPress MU or just an issue with wordpress.com?

Specific to WordPress.com.

Not a general bug in WordPress or WordPress MU.

Does seem a little tricky to find.

security at wordpress.org Listed at http://core.trac.wordpress.org/

Members of WordPress.com are on that mailing list as well.

http://en.support.wordpress.com/contact/ if anything is definitely WordPress.com specific, but I suggest always including security at wordpress org, because there may be another permutation to the attack.