title: Where did utils.php come from, TinyMCE hack
body: <p>Last Wednesday a variety of the WordPress sites I manage got hacked, they were infected with a Viagra link (malware is so original).</p>
  
  <p>I noticed in the wp-includes directory a file called utils.php (wp-includes/js/tinymce/utils/utils.php), also an addition to my general-template.php for the get_footer function.</p>
  
  <p>This hack seems to only affect Google search results for sites, not the site when directly viewed by entering the URL, i.e your cached site will show a malware infested mess and lose ranking, meanwhile you will wonder why due to the site looking fine when viewed.</p>
  
  <p>My host (TSO Host) have cleaned up the sites, didn't even need to ask, but I have no idea how the infection got there in the first place.</p>
  
  <p>So my question is, does anyone know how the breach happens and what I can do to prevent it, other than the usual security tips?</p>