<del>Looks like they fixed it -- good.</del> Exposing your web service code is a huge security issue; at least they were prompt about fixing it (says "Service Unavailable" now rather than serving PHP files)
Edit: Apparently not.
Edit: Apparently not.