About the php2shell issue

[Shishir99]

PGP is better than PHP!

Welcome back, nullius!

What if OpenAI somehow manage to find vulnerabilities in PGP as well?
The AI is scary as fuck now. I heard that a newer model AI can find many old bugs that has been around for a long time and never exposed before. However, I was able to verify your signed message using bitmover's pgp verifier tool - Verified ✅, Anyone should be able to verify using this dedicated link.

Welcome back again.

[Comeacross]

I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

Regardless, the forum admin did well to swing into action quickly and ensure everything is fine. Thank God there was no any successful attack to have access to sensitive data. I wasn't well aware of the situation until night but glad we are back and stronger.

[DYING_S0UL]

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

[robelneo]

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

I contacted my host about these patches, and they gave me a link to their updates about these vulnerabilities

All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities. Thank you for your understanding.

https://www.namecheap.com/help-center/live-chat/

According to WIZover 1.3 million websites were directly exposed

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

Yes, it can be compromised through phishing and man-in-the-middle (MITM) attacks