http://permalink.gmane.org/gmane.comp.s ... eral/19669
This again, this time with both GraphicsMagick and ImageMagick. (HN discussion.)
This one's a bit bad. Apparently Twitter is vulnerable. Some chap did testing with his avatar and can't change it.
The goon server is probably vulnerable, and I haven't yet decided how to approach it given the nature of the last exploit. Sigh. Temporarily disable avatars, maybe?