And LJ haven't posted anything public about it that I can find, which, blech.

There's a thread in news now care of rydra_wong (unlinked URI is in the comments on the OP) where LJ is taking a "caps or it didn't happen" sort of stance. Albeit a friendly, helpful sort of one.

I... can't quite decide whether I could be bothered to continue to help LJ further on the issue or not. It's not like they're going to get rid of the source of the vulnerability, so... meh. Any "fix" would be a temporary one (and a false sense of security) at best. :\