title: How is a website hacked by a "maliciously encoded image that contained a PHP script hidden inside it"?
body: <p>My ad server has been hacked over the weekend.</p>
  
  <p>It seems to be a widespread problem, according to <a href="http://www.pcworld.com/businesscenter/article/185352/hackers_hit_openx_ad_server_in_adobe_attack.html" rel="nofollow noreferrer">this article</a>.</p>
  
  <p>There is something in there that got me thinking...</p>
  
  <blockquote>
    <p>Attackers used one attack to get login
    rights to his server, and then
    uploaded a maliciously encoded image
    that contained a PHP script hidden
    inside it, he said. By viewing the
    image, attackers forced the script to
    execute on the server</p>
  </blockquote>
  
  <p>How is this possible? Does it rely on the image being opened with GD or similar? Do they upload a script posing as an image, and somehow include it?</p>