A company is running a modified version of a GPL'ed program on a web site. Does the GPL say they must release their modified sources?
 
The GPL permits anyone to make a modified version and use it without ever distributing it to others. What this company is doing is a special case of that. Therefore, the company does not have to release the modified sources.
 
It is essential for people to have the freedom to make modifications and use them privately, without ever publishing those modifications. However, putting the program on a server machine for the public to talk to is hardly "private" use, so it would be legitimate to require release of the source code in that special case. We are thinking about doing something like this in GPL version 3, but we don't have precise wording in mind yet.
 
In the mean time, you might want to use the Affero GPL for programs designed for network server use.