About the php2shell issue

[xLays]

Can anyone confirm if you’ve already changed your password without any issues? I’m afraid that if I change mine, I might not be able to log in again. Please let me know if you’ve successfully changed your password and can still access your account without any problems. Thanks.

[Majestic-milf]

 I'm used to cloudfare issues but this one was quite new. And long, if I might add. Kept refreshing the page to see if it was just something temporary. Literally left everyone on timeout but I'm glad Theymos could respond swiftly before any damage was done. Glad to be back.

[nullius]

Yo...? Is this the year of return of the OGs?

Thanks, LOL.  So oft must I wish I hadn’t narrowly missed being a real OG!

Does that apply to accounts that just woke up after over four years?

Wait a minute... YOU'RE ALIVE??? 😲

Technically.

PGP is better than PHP!

Hold on... who's going to confirm that the PHP vulnerability didn't somehow affect PGP too?

Because even though G and H are only one letter apart, it takes four bit-flips to turn an ASCII G (0x47) into an H (0x48).  See?  That’s defense in depth.

Welcome back, by the way! Can we hear the story behind this four-year HODL of your account?

Thank you.  If it is to be told, the story shall involve Cthulhu—or perhaps, Cthulhu’s Doppelgänger, his even-eviller twin—invading a thread where Cthulhu is on topic. ;)

I subconsciously checked the btt page about 10 times forgetting there was an issue and a few more times hoping it had been fixed.

Only 10 times? Those are rookie numbers. :D I probably clicked on bitcointalk bookmark like 50 times yesterday, as I kept forgetting that the site was down.

I archived the error page for posterity.  Then, later, I archived it again!  What else was I to do?

Someday, those archives will be prized relics of Bitcoin Forum lore.  Do you suppose I could sell them in Collectables?

[KingsDen]

Congratulations theymos for the fast response.

Honestly, for over 5 years of my existence here, the forum downtime hasn't been this way. I knew everything would be in order, but I became more sceptical as FBI was mentioned. However, I had to read between lines about the vulnerability of PHP.

Bitcointalk is back, cheers!

I subconsciously checked the btt page about 10 times forgetting there was an issue and a few more times hoping it had been fixed. Made me realise how much I enjoy the conversations here.

Same here!
After Manchester United was trashed by Fabregas Como, I didn't have who to discuss with, the only place to pour my anger was the forum, but I couldn't login. Now, my anger is calm, but I'll still take minutes to read what people said about Manchester United and Carrick.

[decodx]

Man, I bet that wasn't how you planned on spending your day yesterday, @theymos.  

I think you did what you could. Good job, btw! But now you can rest.

Can anyone confirm if you’ve already changed your password without any issues? I’m afraid that if I change mine, I might not be able to log in again. Please let me know if you’ve successfully changed your password and can still access your account without any problems. Thanks.

How about you be the first to change yours, and then tell the rest of us how it went?  

[MArsland]

thanks theymos for the information

I'm in a dilemma between changing my password or not, because it's pretty secure so far. During the closing session of the forum, I continued to monitor emails for fear of suspicious notifications.

[libert19]

Does that apply to accounts that just woke up after over four years?

Wait a minute... YOU'RE ALIVE??? 😲

Four years of silence, and a PHP zero-day not BTC breaking $100k but this is what finally brings you back? 😂

It's about passion, not money. These people, I respect the most.

...

And guess what the prompt was that helped uncover it?

Looks like YT, what's link to video? And yes, great things are often attained with simplicity.

And as expected this vulnerability was reportedly discovered with the help of AI, despite having existed in the codebase for over a decade.

And guess what the prompt was that helped uncover it?

AI is going to attack not only crypto, but every possible human infrastructure. I guess we have to adapt to this new normal.

On the positive side we will end with a stronger infrastructure.

On the negative side, some human could die in the process.

I take it positively. It has made easier for 'defenders' to find vulnerabilities even if same being the case for the other side too. AI has just made a new ceiling to fight on.

I was feeling miserable, I woke up and could not access the forum. Good to be back, good sir!

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Okay. Since you said, 'probably' — I ain't gonna do anything. If I am locked out, we gonna be back with, staked address, baby! (oh fuck!  I don't even remember if I still have access to the wallet but I'd like to delude meself that I do).

Now that's the feeling if you can't access the forum, huh  . Now I know.

No sir. Don't judge from my lenses, be mindful about your own experience.

Can anyone confirm if you’ve already changed your password without any issues? I’m afraid that if I change mine, I might not be able to log in again. Please let me know if you’ve successfully changed your password and can still access your account without any problems. Thanks.

I suggest you to change yours and let everybody else know. (why would there be problem though?)

Theymos

It's small, 't'. Don't disrespect theymos by changing the case of letter. Thanks. If you repeat this mistake again, he might not bother to recover forum next time.

...but I became more sceptical as FBI was mentioned.

What FBI?

I subconsciously checked the btt page about 10 times forgetting there was an issue and a few more times hoping it had been fixed. Made me realise how much I enjoy the conversations here.

After Manchester United was trashed by Fabregas Como, I didn't have who to discuss with, the only place to pour my anger was the forum, but I couldn't login.

Ok, that's new. But, Twitter works fine for rants... in cricket at least. We literally have voice chats whining, complaining, using every abusive words possible.

Edit:

...

I just wasted my 30 seconds translating your personal text thinking it would be anything good and I am disappointed.

[Cookdata]

I pray AI don't be the end of us all. 

Thank you Theymos.

[libert19]

I pray AI don't be the end of us all. 

FWIW, there was somebody prompting AI.

[Upgrade00]

Only 10 times? Those are rookie numbers. I probably clicked on bitcointalk bookmark like 50 times yesterday, as I kept forgetting that the site was down.

You don't take no for an answer eh  
I resigned to fate after a while and only checked thinking "surely, it's back up now"

I pray AI don't be the end of us all.  

It was useful here. There are probably millions of codes that runs tons of sites that no one checks on regularly cause of how long it will take. AI can do that quickly, just that bad actors can also access AI.

[ABCbits]

Glad to see you take action. Anyway, i wonder how many cryptocurrency related website will be hacked in upcoming days/weeks because nobody perform needed security update/review.

[Alvin_talk]

Good to know we have a competent administrator who responds swiftly to security threats. Thanks so much.

It's really great to be back. Some users here might fall sick if the forum no longer exist

I think in addition to changing your forum password, it would also be good to change the email password you used for your forum registration and possibly your exchange password, if it is identical or similar to your forum password.

[joker_josue]

I pray AI don't be the end of us all. 

FWIW, there was somebody prompting AI.

Well, that's the real problem.

Because while we have hackers looking for bugs, we also have software developers ignoring the problems. Having met many IT professionals, I've noticed that this often happens because of pride. They think they are the best, that the methods they use are always the best.

I know very few people in IT who admit that another strategy might be better, especially if the idea comes from someone who isn't in IT and is just an "amateur".

We will still see many IT specialists experiencing setbacks because of this. Because we will see "amateurs" using AI and taking down systems created by "experts".

Don't come with the story that "they can only achieve it because they use AI," because AI is also available to experts. They need to take courage and put aside their pride, using AI to improve their systems.

[knowngunman]

Can anyone confirm if you’ve already changed your password without any issues? I’m afraid that if I change mine, I might not be able to log in again. Please let me know if you’ve successfully changed your password and can still access your account without any problems. Thanks.

What do you mean?

Theymos confirmed that nothing was compromised from his investigation so far and you don't need to take any action. Changing your password is only if you want to take extra step for your own peace of mind.

You should go ahead and change it if you want. It should work fine and if it doesn't, we'll learn from you and fix the issue 

Tbh, your post is scary because it sounds like we need to be worried when admin already confirmed no need to panic 

[Mitchell]

[...]
I think in addition to changing your forum password, it would also be good to change the email password you used for your forum registration and possibly your exchange password, if it is identical or similar to your forum password.

Those should be 3 unique passwords. If they are similar or the same, you really need to start using a password manager :X


Thank you Theymos for the quick response!

[igebotz]

Thank you, theymos! Welcome back fellas.

Ed: we all missed, didn't we? 

[SuperBitMan]

Can anyone confirm if you’ve already changed your password without any issues? I’m afraid that if I change mine, I might not be able to log in again. Please let me know if you’ve successfully changed your password and can still access your account without any problems. Thanks.

What do you mean?

Theymos confirmed that nothing was compromised from his investigation so far and you don't need to take any action. Changing your password is only if you want to take extra step for your own peace of mind.

You should go ahead and change it if you want. It should work fine and if it doesn't, we'll learn from you and fix the issue 

Tbh, your post is scary because it sounds like we need to be worried when admin already confirmed no need to panic 

I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

If he wants to take extra precautions to protect himself then it’s fine, I see nothing wrong in that, but if he knows he those not remember his present password then he can’t change his password to a new one, but it’s very bad to forget your present password, he should try to remember his present password if he forgot it, it’s very important.

If he knows his present password, there’s nothing there to be scared about, he should just carry on and change his password.

Yeah his post is a bit scary, it looks like changing of password is a must case , but I believe those who read what theymos said very well won’t be scared reading his post.

[Jessie2121]

Good to be back, thought this was one of those regular off and on situation that normally take up to 30 to an hour plus before coming back on, never knew this was this serious. At some point I was thinking if somebody or group of persons are somewhere doing their thing to bring down the forum. A big shout out to Theymos, good job.

[libert19]

...

...

I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

If he wants to take extra precautions to protect himself then it’s fine, I see nothing wrong in that, but if he knows he those not remember his present password then he can’t change his password to a new one, but it’s very bad to forget your present password, he should try to remember his present password if he forgot it, it’s very important.

If he knows his present password, there’s nothing there to be scared about, he should just carry on and change his password.

What a jargon! And you can reset password via email.

At some point I was thinking if somebody or group of persons are somewhere doing their thing to bring down the forum. .

I also thought same then note was added which gave context.

[Lida93]

A couple of very serious PHP vulnerabilities were published with very little advance notice. Bitcointalk.org runs on PHP. Unfortunately, I wasn't in a position to react to the announcement quite in time, so the forum wasn't shut down until around 14:30 UTC, 30 minutes after the public announcement of the vulnerability details, and about 7 hours after some details had begun to leak.

When I said Satoshi never did made a mistake of handpicking you as the admin in charge of the Bitcointalk forum, I was more than correct on that. Regardless of the time of intervention from announcement of the vulnerability I think what's most important is that proactive action enough was critically taken.
Since the vast development of artificial intelligence the cyberspace security challenges has become one that is unprecedentedly overwhelming. This year 2026 would for long be remembered as the year when hackers unleashed multiple attacks on websites and many cryptocurrency marketplace and digital assets wallets.

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

It would be very necessary for a password change as you have advised but that for me  would be when I think otherwise base on future experiences in the forum.