About the php2shell issue

[Finebone]

Good one Theymos.
With this line of action and how quickly you responded, it shows that the forum is safe with someone like you in charge, and I appreciate the work you have been doing behind the scene that most of us here never knew of, a job Weldon sir.

[Revolution2025]

one thing you can't take away from theymos is his quick response to security threats

i tell you'll, no one loves the forum better than theymos

could remember when FBI was snitching on the forum against mixers and theymos took proactive measure by banning mixers in order to avoid further snitches by FBI

theymos has been in charge of the forum for almost 15 years, it takes someone who is technically inclined to serve the forum for those numbers of years

long live theymos, long live Cyrus, long live bitcointalk.org and bitcointalkers

[Joy- maker]

I’m not changing my password, I believe we have nothing to worry about however, it’s good to change your password once in a while for safety reasons.

It's fine if you don't want to change your password, beside nobody said there was anything to be worried about. It's best to follow theymos's advice and reset our passwords for security reasons. Also, it's not advisible to keep changing your password frequently as you suggested, because you might confuse it with another password and end up having to request for a password reset via email.

As for theymos, I would like to thank him specially for responding to the situation at earliest possible time. I'm sure things would have gone wrong if he had not acted promptly by shutting down the forum for maintenance.

[theymos]

Theymos, do you use a sandbox for the Bitcointalk servers like SELinux or AppArmor?

Yes, but that wouldn't have prevented database access, since the php-fpm user needs expansive access to the database. However, unless an attacker was being exceptionally careful, they probably would've accidentally tripped a mandatory-access-control policy in the process of feeling out the environment, which would've left a log - and there were no such logs.

Welcome back!

[criptoevangelista]

Glad to have us back! Look, I'm a complete layperson when it comes to system development, cybersecurity, or anything along those lines, but lately we've been seeing a lot of apps, games, and software fall victim to AI-driven reverse engineering. In a way, that's pretty concerning. For those of you who know your stuff, is there any chance our beloved forum could run into issues related to this regarding security?

[Cryptoprincess101]

The forum has turned part of our family such that whenever we are unable to log in, we get so worried just like we do when a loved one or a family member left the house, didn't return and their phone is unreachable, hahaha.

Well done theymos for restoring normalcy.

This was the biggest down time ever on the history of the forum if I am not mistakenly. Anyone out there can correct me if I am wrong.

this is not the biggest downtime in the history of the forum, you can read the thread below to see several times the forum experience long downtime even up to 5 days offline

Bitcointalk history of hacks and vandalism.

[Welsh]

According to the BBC: https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

There's been millions of attempts across the world, but no evidence of successful attempts at the moment. Whether that will change...quite possibly.

Also been reports that several attempts were made before it was made public. So, looks like the exploit was sold / shared prior to the public announcement possibly? Not sure.

Cloudflare boss reveals 'millions' of attempts to exploit PHP flawpublished at 10:01
10:01

Liv McMahon
Technology reporter

We’ve seen a lot of sites go offline as a precaution or to patch the PHP vulnerabilities flagged yesterday.

At the moment, we do not know whether any hackers have successfully exploited the flaws which surfaced in the widely used programming language.

Experts warn it could allow attackers to remotely run malicious code on affected web servers or steal data.

But some large organisations have said they’ve seen a high volume of attempts to breach their systems.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X earlier that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he says.

Amazon also says it saw hackers attempt to exploit the flaws, but so far its websites are operating as normal.

[Zoomic]

The forum is really a great place to 'hang out', and that downtime proved it again. I spent more time on IG in my free time yesterday, than i had done in ages. I know it was only a couple of hours, but i am sure it felt longer than that for a lot of users, because it did for me.

However, good job Theymos, it is great to be back. See you around guys!

Apart from the fact that there's no other community in the globe where you'll interact and learn about Bitcoin like Bitcointalk, this forum also builds discipline and character through the laid down rules guiding it and the punishments that come with violating them.

So many Bitcoiners have made the forum their favorite home to interact, learn and also teach others. That's why a lot of people felt really bad yesterday that the couldn't access it.

What happened yesterday somehow forced us to do a reality check on how important the forum is to a lot of us.

Kudos to Theymos and the technical team for acting swiftly to protect the forum. Though fun to say now, but yesterday, I experienced what it feels like to being locked out from the place you call home  

[Cookdata]

If this continue to happen, that means that the era of bug bounty will be back, and this will enable people use same AI to detect vulnerabilities before the bad players discover it themselves.

We are yet to witness the advert effect of this AI generation, more shockers will happen.

AI are very fast in computation, I don't think it's necessary for any team to wait for bug bounty. Claude AI isn't that expensive, if you can design, create and put a code into work, you should be able to debug and find vulnerability with AI. They don't need to pay bounties unless they are lazy to find it themselves.

Most of the exploit are not done humanly, they use AI as assistant to make it simple. Instead of waiting around to let another jobless person takes advantage of your hard work, the better they do it on there own and patch what's necessary.

I also do not see a lot of sense it on anyways. Whether you change password or not, you will still be affected by any breach. I even think that frequent update of the password will make one begin produce weak or repetitive password pattern that can be guessed.

When I check the second page and I saw people discussing about password, I couldn't understand the purpose, the admin said there was nothing compromised. So we are good. I implore everyone to add 2FA and protect their emails. These two will save you from a lot of troubles as long as the server side remain safe.

[rdluffy]

Wow, that was a really quick response, theymos 
Thank you so much!

Running the forum is a big responsibility, thank you for keeping everything safe and up and running

[libert19]

...how will you feel after a week without bitcointtalk forum?

Yes, this is really nullius, posting in

Does that apply to accounts that just woke up after over four years?

Welcome back. Yes.

Why do you make us work (that's to click the quoted link) to check what that 'yes' response was for?

I have never done this thing of periodically changing passwords. I never found it making any sense. Use a good password (combination of all kind of gymnastics), and forget.

And forget? I guess you really don't mean that part  

I meant as in use strong password and forget, 'care' for it — that is to say no need to change it periodically as was suggested but this is invalidated now since Welsh's explanation (right below).

True. So, periodic change of password doesn't really help with anything, does it? (provided you have chosen a strong password to begin with which brute force attacks are unlikely to breach).

At the end of the day, the idea is by changing regularly, if the malicious user has access to the hashed version they might be working on solving it, but by changing it regularly you make that moot.

Aight. Now I understand the reasoning.

Thus, it leads me to conclude that you are not required to present your present password at all. Just follow the link and set a new one! It would be stupid to require old password anyhow

That's if you reset your password via the "I forgot my password" if you do it within settings, you'll need to enter your current password, this is because you're logged in and any actor who gets access to your computer could potentially try changing the password, so while logged in a password is required if doing it from settings.

However, if your password is of sufficient complexity solving the hash isn't realistic anyway.

Right. I misunderstood. It didn't occur to me, you can change to a new password with present password without reseting password.

I would like to apologize to @SuperBitMan for calling his statement, 'jargon' when it was my own ignorance.

[DubemIfedigbo001]

Good to know that there was no successful attack on the forum. Thank you, theymos, for taking the necessary steps, and we hope everything is okay now. These PHP vulnerabilities affected roughly 70% of all websites globally and disrupted many online activities. This is another example that nothing is certain; it's important to always be prepared. It's great to be back.

Fast response from theymos, I believe he lost a lot of sleep trying to put things in order. That's what it takes to be a good leader, always at the treetop to view the surroundings and act fast before it becomes a serious problem. The response time was legendary.

Most organizations were advised to take their sites down if they're not upgrading immediately, shows how serious the zero-day vulnerability was, activities are better disrupted than exploited. I'm happy we're back.

[Odohu]

30 minutes to respond after the announcement was pretty fast and I want to thank Theymos and his team for that swift action. When I saw the error message that started from Cloudfare error I was worried but later the real issue was stated and that was a little relaxing since it was not peculiar to the forum. It's good that everything is fine with the forum.

[satscraper]

If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that apply to accounts that just woke up after over four years?

Wow, you kept the same login session alive for four years.  

Then, your password is like Bordeaux in cellar that forgot to check on it.

Change it immediately. Server would not endure this any more.  

[Lucius]

It is incredible that no one discovered these vulnerabilities, which are assumed to have existed for at least ten years. The real question in fact is who has been exploiting those vulnerabilities all this time, and what exactly they managed to collect. Welcome to the new world where AI literally tells us, "your time has passed, ours is just coming."

The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz.

Calif, along with PHP Foundation, were part of a program started by OpenAI called Patch the Planet.

Through that program, they were given access to the AI company's advanced AI tools in order to find and fix flaws in web development language.

OpenAI said in a blog post that the discovery was "one of the most impactful security issues in recent memory". It added an internal researcher at the company had also discovered the issue around the same time as the other firms.

The flaws had gone undetected for more than a decade. By August, after a few weeks of using advanced AI tools, they were discovered.

"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said in a blog post.

It has estimated "roughly 70%" of the internet is affected, though the BBC is unable to verify that figure.

[SuperBitMan]

Thus, it leads me to conclude that you are not required to present your present password at all. Just follow the link and set a new one! It would be stupid to require old password anyhow

That's if you reset your password via the "I forgot my password" if you do it within settings, you'll need to enter your current password, this is because you're logged in and any actor who gets access to your computer could potentially try changing the password, so while logged in a password is required if doing it from settings.

However, if your password is of sufficient complexity solving the hash isn't realistic anyway.

Right. I misunderstood. It didn't occur to me, you can change to a new password with present password without reseting password.

I would like to apologize to @SuperBitMan for calling his statement, 'jargon' when it was my own ignorance.

Apologies accepted.
This is why you need to always talk respectfully to everyone, whether the person is right or wrong, sounding rude will only make you look stupid at the end sometimes, i learnt this some years back.

Nobody knows it all, where your knowledge stops is where another persons own starts from, so never think you know it all.

Have a nice day Mr libert19.

[Franctoshi]

That was a swift action, Theymos! And you did a pretty good job with such a response by taking the site down.

This is actually my first time of witnessing a possible attack on here. We're very familiar with the normal message we get on the site when the site usually undergoes some maintenance, but in this one, the message was different, and I became a bit worried at some point about what is happening when I haven't gotten any first-hand information over the reason for the site's take-down.

[Tetu100]

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.
I am happy to see things are resolved now, but similar things are likely to happen in future as hackers are using more AI tools to find bugs everywhere.

I admired the effort made by the admin in putting things on check to ensure that everything is fine again. Perhaps this is one of those things we enjoyed when the people on top are well to do. They are always thinking ahead or thinking out of the box in resolving issues for the betterment of all. However, that was actually a good one from the Admin, keep it up Boss.

[Zwei]

Yes, but that wouldn't have prevented database access, since the php-fpm user needs expansive access to the database. However, unless an attacker was being exceptionally careful, they probably would've accidentally tripped a mandatory-access-control policy in the process of feeling out the environment, which would've left a log - and there were no such logs.

this might be a dumb question, but wouldn't it be possible, if someone had gained enough access would be able to delete or alter the logs to hide their tracks?

It is incredible that no one discovered these vulnerabilities, which are assumed to have existed for at least ten years. The real question in fact is who has been exploiting those vulnerabilities all this time, and what exactly they managed to collect. Welcome to the new world where AI literally tells us, "your time has passed, ours is just coming."

i feel like a new critical vulnerability is found every single day, and those are only the ones that were disclosed or discovered after getting mass exploited. so just imagine how many are out there that are undiscovered/undisclosed or being silently exploited.

[EjiukaSpecial]

Upto 12 hours total of no access to the forum and according to the reports I've read so far, one of the longest outage Bitcointalk have experienced in recent years but that wasn't most attention-capturing part. What really caught my fancy was the different reactions from forum users across different platforms, some panicked raising concerns about possible permanent loss or major exploits, I also saw comments from experienced users who remained calm in their reactions and explicitly expressed their trust in the technical procedures behind the scenes.

The most important part about the whole thing was Theymos' swift response to instantly take the system offline to carefully carryout the necessary technical inspections and block any form of vulnerability, that's an admin that prioritizes absolute integrity over uptime.


Feels good to be back to learn, interact and discuss like one big Bitcoin family again