[eddieroger]

Yeah, I noticed the WebObjects apps were back quick and first. With all of the iOS 7 bugs filed and the App Store in active use, I'm not at all surprised that they are too big to die for the time being. As for the rest of it, my money is on some Ruby descendant, based solely on the fact that all of the Passbook sample code was Ruby based, with a Sinatra app being the server and a signing gem bundled. I think some of Mavericks server utilities are Ruby based, too.

[grey-area]

Isn't the developer portal written in Java too, probably with a mix of frameworks for different components (it certainly had a heterogenous feel on the front end)? I seem to remember some of the signon urls had .woa in them, and one of the former Struts developers mentioned a vulnerability which sounds like a likely candidate:

https://news.ycombinator.com/item?id=6081428

It'd be interesting to know after all this is over what the vulnerability was, though we'll probably never hear from Apple.