After seeing that the feed had been hijacked I poked around to see how easy it was.

My first guess was http://macrumorslive.com/admin which contained the full source code and password hashes to everything on the site.

They must have had a strange configuration because their .php files were showing as plain text files. This revealed their master DB username/password along with many other ways to exploit the site.

There's a reason security through obscurity doesn't work. Unfortunately MacRumors had to find out on what was probably their biggest day of the year.