Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability in Tumblr? Something else?