<del>Looks like they fixed it -- good.</del> Exposing your web service code is a huge security issue; at least they were prompt about fixing it (says "Service Unavailable" now rather than serving PHP files)
Exposing your code isn't a security issue if your code is written properly in the first place. You shouldn't be putting any private keys into your code.
