WordPress version 2.8.6 was released earlier today which addressed a couple of security issues. WordPress 2.8.6 patches a XSS vulnerability in Press This and another issue with sanitizing upload file names which could be exploited to run a php file uploaded as file.php.jpg in some apache configurations.
It is recommended to download and upgrade to version 2.8.6 or use the automatic upgrade function of WordPress under Tools > Upgrade from the admin area. WordPress 2.8.6 will be available for automatic upgrade soon.
Related posts:
This update was really unexpected.. though this update seems to be only for those
who have multi author blogs or is it for every one?
This update is for single author and multi-author blogs… The vulnerability with the uploaded file is actually an apache configuration problem which can be exploited using the WordPress media upload function.