any one else experience mysql hacking? all customers mysql gone true..

I don't allow outside access to MySQL... local socket connections are the safest.

i totally agree.

I *think* I have MySQL blocked off at the firewall. But I'm not sure. I've been meaning to do an extensive review of my firewall rules with a Nessus report in hand, but it just hasn't been a priority for me with my server only being used for personal use.

That said I'm pretty sure I have permissions for MySQL set up to only allow connections from localhost. That's not good enough though, if there were an exploit found.

Add to my.cnf:

skip-networking

This will disable connections to MySQL except through the socket.