About the php2shell issue

[Yablee0]

Initially, I almost got worried but after reading some news about PHP cyber security update news worldwide to avoid the site been affected later, I was relieved and hope to see the forum start working again but I didn't expect it to be this fast. I'm happy that the forum is back and we can continue from where we stopped. Theymos, you're more than a genius to fix this ASAP.

I initially panic as well, let me be sincere here. But the later update that prompted gave me the hope that all will soon be well. That said. Theymos at his end was super proactive and was able to address the issue at once. All thanks to him and his team for making this forum a more better place.

[Silverstonez]

It’s always good to be back again. A lot has already been said on the thread, so there’s not much left to add. I’m just glad that the admin reacted to the situation as quickly as possible, because the HPH issue needed to be addressed promptly before things got out of hand. And as the admin has said, it will cause nothing to reset our passwords, therefore I will reset mine as soon as possible. Thanks again sir theymos for reacting to the situation as quickly as possible, you are indeed a great admin.

[un_rank]

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

If your password is breached, it doesn't matter how random your selection of characters are, scammeers will gain access. A good password protects you from bruteforce not from flaws in the security code of the website making you vulnerable.

Your trust in not changing passwords should be based on the forum security system and the depth of checks done to ensure there is no risk and not the strength of your website.

- Jay -

[dkbit98]

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.
I am happy to see things are resolved now, but similar things are likely to happen in future as hackers are using more AI tools to find bugs everywhere.

[SuperBitMan]

...

...

I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

People that are advised to change their password periodically are those who allow others to have access to their system or those who always use one password in every other thing, it’s advisable to change password periodically across, because if it leaks you are finished.
So it’s not really about how strong your password is, changing of password won’t cost anything so if changing it periodically can keep you safe is good to do it always.

If he wants to take extra precautions to protect himself then it’s fine, I see nothing wrong in that, but if he knows he those not remember his present password then he can’t change his password to a new one, but it’s very bad to forget your present password, he should try to remember his present password if he forgot it, it’s very important.

If he knows his present password, there’s nothing there to be scared about, he should just carry on and change his password.

What a jargon! And you can reset password via email.

It’s been a very long time I changed my email password so I actually have forgotten how it’s been done, but I remember if you request for password reset, they send a link to your email and then you change your password from there, I can’t really remember if they usually ask for your recent password and then your new password.

[Pikiboy]

You know, I was online when the forum shut down and I was like "how do I reach to theymos and few other admin. Like, lot of things was ringing in my head whether if Theymos is sleeping or not.
Maybe the site has been hijacked or what? Before I have to understand that was the PHP issues after a friend share with me about the situation on ground then I have to stop panicking.

Anyway thank you Theymos for the action taken.

[uchegod-21]

You have done well, Theymos. Thanks for the efforts you put into ensuring that everyone is safe. The recommended password change is a good one, but I do not think there is anything we should worry about now.

Truly, yesterday's shutdown was the longest I have experienced since joining the forum. I am glad the forum is open to users again; otherwise, I would have panicked if it had remained inaccessible until now. Welcome back, everyone!

[DPHOR]

This was the biggest down time ever on the history of the forum if I am not mistakenly. Anyone out there can correct me if I am wrong.
Although, from where I have to meet the forum.

You have done well boss theymos bringing back the site online.

[NotATether]

Theymos, do you use a sandbox for the Bitcointalk servers like SELinux or AppArmor?

It's going to be a long day.... 

[libert19]

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

If your password is breached, it doesn't matter how random your selection of characters are, scammeers will gain access.

Obviously .

A good password protects you from bruteforce not from flaws in the security code of the website making you vulnerable.

True. So, periodic change of password doesn't really help with anything, does it? (provided you have chosen a strong password to begin with which brute force attacks are unlikely to breach).

Your trust in not changing passwords should be based on the forum security system and the depth of checks done to ensure there is no risk and not the strength of your website.

I TRUST THEYMOS ^{[despite my older account getting hacked in 2015 hack]}...! Elsewhere, let's not talk about it and ^{[italic part flew above my head]}...!

- Jay -

- libert19 -

Edit 2: Space added.

changing of password won’t cost anything so if changing it periodically can keep you safe is good to do it always.

The task of changing passwords periodically causes monumental burden on my brain cells.

It’s been a very long time I changed my email password so I actually have forgotten how it’s been done, but I remember if you request for password reset, they send a link to your email and then you change your password from there, I can’t really remember if they usually ask for your recent password and then your new password.

This is what password reset page says: https://talkimg.com/image/a2unwc

Thus, it leads me to conclude that you are not required to present your present password at all. Just follow the link and set a new one! It would be stupid to require old password anyhow ^{[I forgot that's why I am resetting dumbass]}...!

Or you could be confounding being able to reset password by answering secret question?

You know, I was online when the forum shut down and I was like "how do I reach to theymos and few other admin.

I think discord is the only place where you can connect with other Bitcointalk admin, Cyrus, I reckon he is admin of pizza related group there.

^ Please correct (cause, I am not active on discord these days), this is my half-assed memory.

Edit: ^^ Check Cyrus's signature to find answer to your question, s/he also has Twitter handle linked.

[KingsDen]

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.
I am happy to see things are resolved now, but similar things are likely to happen in future as hackers are using more AI tools to find bugs everywhere.

If this continue to happen, that means that the era of bug bounty will be back, and this will enable people use same AI to detect vulnerabilities before the bad players discover it themselves.

We are yet to witness the advert effect of this AI generation, more shockers will happen.

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

I also do not see a lot of sense it on anyways. Whether you change password or not, you will still be affected by any breach. I even think that frequent update of the password will make one begin produce weak or repetitive password pattern that can be guessed.

[Agbe]

Several attacks? Thank God you put things in place to secure the forum. It was good for the response and the security architecture set on the forum. Different thoughts came to different individuals but all still arrived at one idea of under maintenance and possible ddos attack because this was the longest shut down of the forum as I came. And your advise is good for the changing of password and other credentials.

[Renampun]

Thank you theymos for your action that was so responsive in handling those PHP vulnerabilities in our forum..

It's so great to be back on this forum 

[Supreme Donvic]

I did not log in yesterday evening so I never knew the forum was down up until seeing this post, I'm sure a lot of people were very worried, thank God the forum is back.

I want to ask a question, if you wake up one morning and the forum is gone forever, how will you feel after a week without bitcointtalk forum?

[GiftedMAN]

Thank you Theymos for being proactive. It is good to know that nothing happened but this is yet another opportunity to remind us the importance of security and to always have different measures to safeguard the things we love end cherish.

Kudos to all those who have been working so hard to ensure the safety of the forum.