Apache.org hit by targeted XSS attack, passwords compromised