Apparently, there was a flaw in previous versions of WordPress that allowed a subscriber to assume more control over a blog than intended. For those of you with your own WordPress installations, please upgrade to 2.3.3 now. I do not know if this also affects stand-alone WordPress MU installs (Jim, you might want to check on this one), but those blogging through WordPress.com should be safe.
Also, if you’re running the WP-Forum plugin (I’m not), it is highly recommended you disable it until a major security flaw is fixed.