About the php2shell issue

[BitBakerr1]

Is good to be back, theymos you have done very well and I really appreciate the effort you put in this forum to make sure we have an amazing experience.
I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

[OcTradism]

Several attacks were attempted, but those particular attacks were blocked by Cloudflare, and also would've failed anyway due to certain configuration details.

At least with this incident from PHP2shell, Cloudflare shows that it is helpful even it's not good for privacy, like a honey pot from CIA, you said it years ago.

Thank you theymos for quickly took action and investigated everything immediately after you were aware of this issue.

https://x.com/cz_binance/status/2113029289155178716

Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches.

Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early.

Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits.

Stay SAFU!

theymos was fast and this forum is SAFU!

[LTU_btc]

Yesterday it was strange evening - felt emptiness without Bitcointalk. Good that everything is fine now. Thank you theymos for fast reaction.

This was probably one of the longest forum downtime I remember in a while, and I saw other forums and websites were also affected.

IIRC in my early days here Bitcointalk was down for few days. Or maybe I'm confusing it with DDoS attacks. Bitcointalk was so slow that it was almost impossible to load pages, not even talking about posting.

[Perfectbaby]

It becomes too scary to lose the forum.
When I noticed the error message, I was like what is going on, after which I had to see something like site on a maintenance that it would come back within few hours or probably today, then I had to know that they are working underneath.

Thank you for bringing the site to live.

[decodx]

this might be a dumb question, but wouldn't it be possible, if someone had gained enough access would be able to delete or alter the logs to hide their tracks?

No, I don't think so. If the server is configured properly, system and security logs are written to isolated directories with restricted permissions. This vulnerability was at the PHP level, not at the server level. Therefore, an attacker who has "only" execution access as the PHP user would need to exploit a secondary vulnerability in order to reach a level that would enable him to access the logs.

[nullius]

Theymos, do you use a sandbox for the Bitcointalk servers like SELinux or AppArmor?

Yes, but that wouldn't have prevented database access, since the php-fpm user needs expansive access to the database.

That boils down to a classic Confused Deputy problem.  (Yup, Hal Finney shows up in the weirdest places!  Sorry the linked old website doesn’t seem to support TLS.)

Welcome back!

Thank you.  It’s as if the forum will never, ever let me go!

[...]
I think in addition to changing your forum password, it would also be good to change the email password you used for your forum registration and possibly your exchange password, if it is identical or similar to your forum password.

Those should be 3 unique passwords. If they are similar or the same, you really need to start using a password manager :X

Security experts also recommend that you sweep your coins to a new wallet, if your brainwallet password is identical or similar to your forum password.

If your password is based on your great-grandmother’s maiden name, your birthday, and your favourite colour, then you need to change all of those, too.  And don’t forget that you should only give your brainwallet password or BIP-39 seed phrase to someone who asks by PM, if they are at Hero Member rank or higher—or if they are an AI.

Does that apply to accounts that just woke up after over four years?

AFAIK, if you logged in after the hotfix, then probably OK.

Thanks for the info.  I was more concerned that someone may suspect my account was hacked; it is why I included a PGP-signed message in my first post.  Immediate password change after account wakeup is sometimes seen as a red flag for a hacked account—thus my question.

(If this account ever claims that CSW is Satoshi, it was definitely hacked.)

[OcTradism]

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

IF password change is recommended, how about changing captcha bypass code?
Do you have any advice on captcha bypass code?

2FA code is different so it does not need to change 2FA

If you use the forgotten-password function, then there's an option to remove the 2FA. So 2FA does not provide any protection in case of a compromised email. Make sure that your email address is secure.

[alani123]

How were the actions so fast? Is there a reliable service offering push notifications for CVEs?

[LoyceV]

IF password change is recommended, how about changing captcha bypass code?
Do you have any advice on captcha bypass code?

With a strong password, you shouldn't worry about someone attempting to brute-force it through an online connection.

[DireWolfM14]

I guess my withdrawals were not in vain.  Thanks for getting us back online as quickly as you did, theymos.

~

Well, there goes the neighborhood. 

j/k, welcome back!

[Queen Julie]

The older version of PHP no longer releases updates.

Old website owner using old version of PHP will have to rebuild their site.

[nullius]

Cross-reference:  My backup of my Bitcoin Forum credentials!

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

IF password change is recommended, how about changing captcha bypass code?
Do you have any advice on captcha bypass code?

2FA code is different so it does not need to change 2FA

In the abstract, those are simply three shared secrets.  However, only a salted hash of the password should be stored by the server—whereas the other two codes must be stored by the server, or else easily constructed from other information stored by the server.

If you’re worried about it, why not change everything?

I just changed my password, set and then reset 2FA (which was created in my absence), and changed my captcha bypass code.  Then, to make sure I don’t lose these login credentials, I pasted them into a post in the off-topic forum.  It is my Enterprise Cloud Backup Solution (patent pending).

For other reasons, I intend to change my email not far in the future.  Just noting it for reference.

~

Well, there goes the neighborhood. 

j/k, welcome back!

Thanks.  Well, so much for my attempt to sneak back in unobtrusively; as a humble, passive personality, I tried to slip in under cover of people’s relief that php2shell didn’t burn down the neighborhood.

[Welsh]

Thanks for the info.  I was more concerned that someone may suspect my account was hacked; it is why I included a PGP-signed message in my first post.  Immediate password change after account wakeup is sometimes seen as a red flag for a hacked account—thus my question.

I think we can give users a pass considering the circumstances . Welcome back .

Considering theymos themselves also changed their password according to the seclog. They deemed it an appropriate measure. Seems a lot of other users haven't though.

[Mitchell]

[...]

The older version of PHP no longer releases updates.

Old website owner using old version of PHP will have to rebuild their site.

Technically true, but some distributions and vendors are building/have provided backports for older PHP version, so worth checking before rebuilding/having to upgrade. Of course, you should never run an EOL version, but shit happens.

[philipma1957]

I just changed mine out of an abundance of caution.

I will also do no sales or buys from now until dec 1 on bitcointalk

[InvoKing]

Thanks for the info.  I was more concerned that someone may suspect my account was hacked; it is why I included a PGP-signed message in my first post.  Immediate password change after account wakeup is sometimes seen as a red flag for a hacked account—thus my question.

I think we can give users a pass considering the circumstances . Welcome back .

Considering theymos themselves also changed their password according to the seclog. They deemed it an appropriate measure. Seems a lot of other users haven't though.

Theymos themselves or administrators themselves?
I don't count to change anything unless it was imposed. The recommendation grade is not high apparently.

[alegotardo]

I think we can give users a pass considering the circumstances . Welcome back .

Considering theymos themselves also changed their password according to the seclog. They deemed it an appropriate measure. Seems a lot of other users haven't though.

Theymos themselves or administrators themselves?
I don't count to change anything unless it was imposed. The recommendation grade is not high apparently.

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?
This could be done right after login requesting a new password, or expiring the current pass and requiring it to be reset exclusively by the link received at email.

Maybe this is not so straightforward right now (especially since this was a suggestion, not an order from the administrator), but perhaps in the future.... I hope this will never be necessary.
Other services have already activated this type of feature after security breaches.

[philipma1957]

I think we can give users a pass considering the circumstances . Welcome back .

Considering theymos themselves also changed their password according to the seclog. They deemed it an appropriate measure. Seems a lot of other users haven't though.

Theymos themselves or administrators themselves?
I don't count to change anything unless it was imposed. The recommendation grade is not high apparently.

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?
This could be done right after login requesting a new password, or expiring the current pass and requiring it to be reset exclusively by the link received at email.

Maybe this is not so straightforward right now (especially since this was a suggestion, not an order from the administrator), but perhaps in the future.... I hope this will never be necessary.
Other services have already activated this type of feature after security breaches.

Not a bad idea. I am now the owner of a new password.

Maybe he can plan for it and do it  with a longer warning.

[saory]

Just some kids playing to be a hacker bitcoin still safe and the forum too. like old times