I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago that the links to the blog were broken, caused by several of the symlinks involved in our installation being missing; however most if not all of the actual files are intact. I'm fairly certain this was done maliciously, my question is whether there are any Movable Type exploits that could have been used to do this or whether my site has a larger vulnerability that was exploited. The only suspicious files I've found so far are files called "1.do" and "1.php" in one of the movable type directories; both nothing but an empty pair of single quotes. Their modification dates also correspond with the first times I found the blog pages not loading in my Apache access logs.
Anyone know what exploit may have been used and what I can do to prevent it from happening again? I have three load-balanced web servers running CentOS 5.9 and the Movable Type installation was 5.12