What has been reported for the past two weeks or so is an issue called transaction (id) malleability: A hash calculated from each bitcoin transaction, the transaction id or txid, can be changed until the transaction is confirmed in the blockchain, by third parties. This deviates from the intuitive, and presumably intended, behavior. Any attempt to spend unconfirmed transactions is vulnerable to a denial-of-service attack where the attacker tries to change the transaction id, denying future spending until the spender updates his idea of what happened to his wallet with the blockchain and re-issues those transactions that build on a wrong expectation of what transaction id would be incorporated into the blockchain. Large bitcoin services' hot wallets with their high transaction volume are particularly likely to be vulnerable, since before this issue became known, it would have been very natural to simply keep producing transactions building upon unconfirmed prior transactions.
To turn this denial-of-service attack into something more like a theft requires some social engineering. In the denial-of-service attack, the attacker can potentially force the wallet operator to
reduce the rate of his bitcoin transactions to one per new block and bitcoin address, all whilst in a sense hiding the occasional successful transaction because it confirms under an unexpected, changed transaction id. If an attacker can use these circumstances to convince the service provider that he did not receive a bitcoin payment he is entitled to (possibly pointing to the wrong original transaction id), he may be able to trick the service provider into initiating a new transaction. And maybe a third one or even more. This may have happened to MtGox.
For a longer and colorful description of this hypothesis, see the question Wouldn't the “malleable transaction” attack be foiled by common sense?.