Reason why BitcoinTalk was down today (21 Oct)

[TryNinja]

Before we see 10 topics asking the same question...

BitcoinTalk runs on the PHP programming language.

Today the PHP team released an emergency update that fixes PHP2Shell, a vulnerability that could potentially hack into any server that has a website running PHP.

theymos had to shutdown the forum to update PHP to the latest version.

Technical details:

https://www.php2shell.com
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Many other websites were taken offline today, for updating.

I guess we're good now.


edit:

Theymos' update:  About the php2shell issue

A couple of very serious PHP vulnerabilities were published with very little advance notice. Bitcointalk.org runs on PHP. Unfortunately, I wasn't in a position to react to the announcement quite in time, so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

Therefore, after upgrading PHP, I spent a lot of time investigating things to see if there were any traces of any successful attacks, but I couldn't find any. Several attacks were attempted, but those particular attacks were blocked by Cloudflare, and also would've failed anyway due to certain configuration details. Also, there were no logs of php-fpm processes crashing, or of a large number of POSTs in quick succession in the vulnerable window -- either/both of which I think would've been seen in a successful attack. I also checked a large number of other things, including checking some sensitive database tables for changes, checking aggregate network stats, checking various possible ways that backdoor-insertion could've been attempted, etc.; but there were no such traces that I could find. That said, there simply isn't comprehensive enough logging to completely exclude the possibility of a successful attack that I wasn't subsequently able to detect.

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

So I think I'll lock this.

[Cyrus]

Confirmed. An announcement by theymos should be expected shortly. Welcome back, Bitcointalk and thank you theymos for adressing this so fast!


EDIT: Here's the announcement by theymos: https://bitcointalk.org/index.php?topic=5597507

[PX-Z]

Many other websites were taken offline today, for updating.

But many aren't, even though they are running PHP too.

Well, anyway, i guess it's for them to answer and do the updates unless they are using the latest PHP version.

Welcome back!

[promise444c5]

Welcome back guys.. you can return those CVs now  

[RGBTC]

Well, having Bitcointalk offline for about 12 hours felt like the world had frozen.
I’ve been looking into reports from government-related cybersecurity entities such as the NSA and NCO that have recommended taking PHP-based sites offline.

But many aren't, even though they are running PHP too.

According to the official website https://www.php.net, sites running PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 need to update their server scripts immediately.

Edit: We were offline again for a few secs 

[Nwada001]

When I noticed the site down, I thought it was the usual Cloudflare until I saw the announcement on X about PHP vulnerability.

I’m glad we are back online again.

Before we see 10 topics asking the same question...

I hope the help as many worried members might have already arranged there topic waiting for the forum to be back online to publish it.

[PX-Z]

But many aren't, even though they are running PHP too.

According to the official website https://www.php.net, sites running PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 need to update their server scripts immediately.

Yes, because that's the PHP version they (devs) are maintaining, those sites running with lower versions don't have the option to do so, but to upgrade to the newest or maintained version.

And i saw some or most government sites are all running yesterday, either they are just okay or doesn't even care at all.

[Btcdeybodi]

The forum has turned into a friend such that we get worried whenever we are unable to access it. 12 hours of suspense felt like the journey of the Israelites out of the land of Egypt.

Welcome back family  

theymos had to shutdown the forum to update PHP to the latest version.

Very swift response from theymos, as usual 

[mikel_012]

Yes, because that's the PHP version they (devs) are maintaining, those sites running with lower versions don't have the option to do so, but to upgrade to the newest or maintained version.

And i saw some or most government sites doesn't care, all of them were just okay or doesn't even care at all.

Many government websites in Brazil run with PHP and I do not think they will update soon, because the websites are poorly made and are not updated frequently

I think we will see more leaks and hacks soon because of this exploit

Thank you theymos for the quick action so our forum is not at risk even for 1 minute

[promise444c5]

According to the official website https://www.php.net, sites running PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 need to update their server scripts immediately.

Nope.. it probably affected older ones too but as you can see :

“ PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.”
Source: https://www.php.net/index.php

So, they only provided fix for the recent ones ^ 8.2.xx , specifically those were listed on the GitHub links posted by TryNinja.

[yhiaali3]

Hello everyone, welcome back BitcoinTalk forum.
It's been a tough time indeed as the forum has become a part of our daily lives.

When I tried to access the website and saw the error, I began searching online to see if there was any news or updates regarding the cause and when it might be back up.

It occurred to me at the time: why doesn't the BitcoinTalk have a Telegram channel or group, or a Facebook page, for exchanging information in situations like this?

[Smartvirus]

The prompt that was received was enough for cool heads, at least a lot of users were well aware of a maintenance, not common with the forum but one out of necessity and it was only going to take few hours or at most, up until the 22nd. 22nd it is and still within hours.

It was a proactive approach to ensure privacy and security of user data, even when there was no suspicion on a breach, best to work with updates on possible vulnerabilities while it’s still safe.

Read something on the PHP vulnerability which could allow bad actors to run codes without proper authorization and it’ll be treated by the system as valid. Hope, we’ve nothing to isolate and report to the FBI here, that’s still part of the procedure.

TryNinja, you didn’t experience this alone and definitely wouldn’t be the only one having a thread about it, just keep that report button real close.

[Cyrus]

It occurred to me at the time: why doesn't the BitcoinTalk have a Telegram channel or group, or a Facebook page, for exchanging information in situations like this?

There's this Twitter handled that's AFAIK controlled by theymos: https://x.com/bitcointalk
There's also an unofficial Discord server, pretty quiet these days.

[taufik123]

There's this Twitter handled that's AFAIK controlled by theymos: https://x.com/bitcointalk
There's also an unofficial Discord server, pretty quiet these days.

Maybe you need to update on X or the social media that bitcointalk has, so that this kind of information can be discussed directly.
The last time I updated on X in 2023, it was a very long time.


And not only the Bitcointalk forum, but even Wikipedia, the Internet Archive, and several government websites in Europe had shut down their services for security

[rbynxx]

Well, I think that was the longest downtime I've experienced here in the forum. Great to be back and thanks to theymos!

[TryNinja]

Theymos' update:  About the php2shell issue

A couple of very serious PHP vulnerabilities were published with very little advance notice. Bitcointalk.org runs on PHP. Unfortunately, I wasn't in a position to react to the announcement quite in time, so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

Therefore, after upgrading PHP, I spent a lot of time investigating things to see if there were any traces of any successful attacks, but I couldn't find any. Several attacks were attempted, but those particular attacks were blocked by Cloudflare, and also would've failed anyway due to certain configuration details. Also, there were no logs of php-fpm processes crashing, or of a large number of POSTs in quick succession in the vulnerable window -- either/both of which I think would've been seen in a successful attack. I also checked a large number of other things, including checking some sensitive database tables for changes, checking aggregate network stats, checking various possible ways that backdoor-insertion could've been attempted, etc.; but there were no such traces that I could find. That said, there simply isn't comprehensive enough logging to completely exclude the possibility of a successful attack that I wasn't subsequently able to detect.

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

So I think I'll lock this.