At the beginning of September, a user by the name of ‘maxymax’ forked WordPress, added a PHP Shell to the twentyten theme, and made a pull request to merge back in to the official release.
https://github.com/maxymax/WordPress/commit/2fa93590c7881fab043be7b8b51358894dbc1466
Suffice to say the inclusion of Saudi Shell v1.0 in TwentyTen may not have been the best idea, nevermind the total lack of obfuscation or concealment.
![githubpullreq](http://www.tomjn.com/wp-content/uploads/2012/09/githubpullreq-934x1024.png)
Since the original pull request no longer exists, I’ve taken the liberty of mirroring a copy of the last available Google cache here as an mht file, for all to view.