About the php2shell issue

[theymos]

A couple of very serious PHP vulnerabilities were published with very little advance notice. Bitcointalk.org runs on PHP. Unfortunately, I wasn't in a position to react to the announcement quite in time, so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

Therefore, after upgrading PHP, I spent a lot of time investigating things to see if there were any traces of any successful attacks, but I couldn't find any. Several attacks were attempted, but those particular attacks were blocked by Cloudflare, and also would've failed anyway due to certain configuration details. Also, there were no logs of php-fpm processes crashing, or of a large number of POSTs in quick succession in the vulnerable window -- either/both of which I think would've been seen in a successful attack. I also checked a large number of other things, including checking some sensitive database tables for changes, checking aggregate network stats, checking various possible ways that backdoor-insertion could've been attempted, etc.; but there were no such traces that I could find. That said, there simply isn't comprehensive enough logging to completely exclude the possibility of a successful attack that I wasn't subsequently able to detect.

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

[Cyrus]

That was pretty fast though, thank you theymos!

Good to be back, Bitcointalk!

[eaLiTy]

Thank you for the update. I am glad the site is back online after such a short period. Welcome back everyone. 

[Smartvirus]

That was a lot of work within the short window you had to be sure the forum is usable and ensure user data safety and protection, nice work.

Perhaps the emergency patch serves its purpose and not comes out to be faulty given the time needed to respond rather than react to discovered vulnerability. It’s really does come at much ease to have dedicated teams handling these safety checks and updates and always have a patch ready.

[libert19]

I was feeling miserable, I woke up and could not access the forum. Good to be back, good sir!

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Okay. Since you said, 'probably' — I ain't gonna do anything. If I am locked out, we gonna be back with, staked address, baby! (oh fuck!  I don't even remember if I still have access to the wallet but I'd like to delude meself that I do).

[Gozie51]

That was fast, proactive and quick measure taken by you theymos to protect the forum. The advise of possible change of password is handy, just incase.

Welcome back after some hours, the first time I noticed the forum being down for such hours.

[nullius]

The meltdown of the world’s worst programming language brought forth your worst nightmare:  In the depths of the void, it has awakened from a deep sleep a nullity.

Just kidding.  Actually, the forum’s shutdown delayed my return.  But could I pass up the opportunity for a grand entrance?

To put your mind at ease, and to avoid conspiracy theories:

Code:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Yes, this is really nullius, posting in:

https://bitcointalk.org/index.php?topic=5597507.0

ALWAYS VERIFY DIGITAL SIGNATURES.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSNOMR84IlYpr/EF5vEJ5MVn575SQUCatmWsQAKCRDEJ5MVn575
ST7TAQCM7qO+YVG7h0gbXvdjYEFDZjEobMEjykIToj2732HhbwEA3dTDoeQzVWW5
RkHYsOnwXAbrTTwLeMZgs6PElPmnPw4=
=vwCc
-----END PGP SIGNATURE-----

PGP is better than PHP!

If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that apply to accounts that just woke up after over four years?

[OgNasty]

Thank you for your quick action theymos.

[hmbdofficial]

That was really fast reaction @theymos, I didn’t noticed the forum was down  actually until after I was trying to access the learnmeabitcoin website that also runs on php and it was giving errors 502, then later I saw the error 503 on the forum also, i didn’t see the news quickly, But its good to know there was no successful attack on the forums data. It’s feels good to be back again. However, I’m not gonna change my password though I’m just cool with that I was using.

[libert19]

...

Yo...? Is this the year of return of the OGs? I saw the hodl guy return a week or so back and now the great nullius (as in crypto knowledge) O_O (secretly hopes for Satofan44's return).

[Ambatman]

2026 Is getting more dramatic with unwanted Developments.
It's like every month something pops up.
And the thing they all have in common is AI.

https://www.aljazeera.com/amp/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming
Thank you for the swift update.
It was more of a shocker when I noticed some other sites being down. I doubt all were updated or got the message.
 

[Fiatless]

Good to know that there was no successful attack on the forum. Thank you, theymos, for taking the necessary steps, and we hope everything is okay now. These PHP vulnerabilities affected roughly 70% of all websites globally and disrupted many online activities. This is another example that nothing is certain; it's important to always be prepared. It's great to be back.

[shahzadafzal]

Does that apply to accounts that just woke up after over four years?

Wait a minute... YOU'RE ALIVE??? 😲

Four years of silence, and a PHP zero-day not BTC breaking $100k but this is what finally brings you back? 😂

PGP is better than PHP!

Hold on... who's going to confirm that the PHP vulnerability didn't somehow affect PGP too?

Welcome back, by the way! Can we hear the story behind this four-year HODL of your account?

---

A couple of very serious PHP vulnerabilities were published with very little advance notice. Bitcointalk.org runs on PHP. Unfortunately, I wasn't in a position to react to the announcement quite in time, so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

Nah, man! That was still faster than many of us expected. Hats off to you guys for reacting so quickly!

The funny thing is, when I first visited the forum, all I saw was the default 503 Service Temporarily Unavailable error.

I was literally about to message @Cyrus on Discord and suggest putting up a custom maintenance page with some explanation.

But before I could even send the message, I refreshed the page, and there it was! A proper maintenance notice explaining the situation.

I immediately told myself: "Shut up and stop trying to be smart. These guys clearly know what they're doing and what needs to come first!"

Anyway, excellent work, theymos. Security first, fancy error pages later!

And as expected this vulnerability was reportedly discovered with the help of AI, despite having existed in the codebase for over a decade.

And guess what the prompt was that helped uncover it?

[Upgrade00]

I subconsciously checked the btt page about 10 times forgetting there was an issue and a few more times hoping it had been fixed. Made me realise how much I enjoy the conversations here.

Quick and efficient response theymos. It was a chaotic couple of hours on the Internet, a lot of websites relying directly or indirectly on PHP. The critical vulnerability level being so high just added to the chaos. Hopefully there were no issues here that went undetected.

[Frankolala]

Initially, I almost got worried but after reading some news about PHP cyber security update news worldwide to avoid the site been affected later, I was relieved and hope to see the forum start working again but I didn't expect it to be this fast. I'm happy that the forum is back and we can continue from where we stopped. Theymos, you're more than a genius to fix this ASAP.

[Rikafip]

I subconsciously checked the btt page about 10 times forgetting there was an issue and a few more times hoping it had been fixed.

Only 10 times? Those are rookie numbers. I probably clicked on bitcointalk bookmark like 50 times yesterday, as I kept forgetting that the site was down.

Anyway, good to see its back.

[fillippone]

And as expected this vulnerability was reportedly discovered with the help of AI, despite having existed in the codebase for over a decade.

And guess what the prompt was that helped uncover it?

AI is going to attack not only crypto, but every possible human infrastructure. I guess we have to adapt to this new normal.
On the positive side we will end with a stronger infrastructure.
On the negative side, some human could die in the process.

[joker_josue]

Congratulations @theymos for the quick response to the situation.

I also believe that you were quick enough not to have suffered any attack.


In turn, this case clearly showed that development teams insist on ignoring advances in AI. Moreover, in this case, they already had some validation that the bug existed.

Finally, problem solved, now it's time to pay attention to the next one.

[Asuspawer09]

Great to be back! Thanks for the quick fix and updates!

Initially, I almost got worried but after reading some news about PHP cyber security update news worldwide to avoid the site been affected later, I was relieved and hope to see the forum start working again but I didn't expect it to be this fast. I'm happy that the forum is back and we can continue from where we stopped. Theymos, you're more than a genius to fix this ASAP.

The same thoughts came to a conclusion pretty quickly that it might be something serious because of the news saying about vulnerabilities and emergency something like that...

There are a lot of websites and platforms that are taken down, even government websites.

I was feeling miserable, I woke up and could not access the forum. Good to be back, good sir!

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Okay. Since you said, 'probably' — I ain't gonna do anything. If I am locked out, we gonna be back with, staked address, baby! (oh fuck!  I don't even remember if I still have access to the wallet but I'd like to delude meself that I do).

Now that's the feeling if you can't access the forum, huh  . Now I know.

[Donneski]

Good to know that there was no successful attack. I was getting really livid yesterday after trying for over 6 hours to access the forum without success. It was only after I saw a tweet from NSA about leaked proof-of-concept code that hackers were using to find vulnerable, unpatched sites that I became a little more settled. I concluded that in reaction to the news, the forum must have been deliberately taken down for PHP maintenance or an upgrade to patch possible vulnerabilities. Thank you for the quick response with the technical team and also taking your time to explain what really transpired yesterday.