About the php2shell issue

[Shishir99]

PGP is better than PHP!

Welcome back, nullius!

What if OpenAI somehow manage to find vulnerabilities in PGP as well?
The AI is scary as fuck now. I heard that a newer model AI can find many old bugs that has been around for a long time and never exposed before. However, I was able to verify your signed message using bitmover's pgp verifier tool - Verified ✅, Anyone should be able to verify using this dedicated link.

Welcome back again.

[Comeacross]

I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

Regardless, the forum admin did well to swing into action quickly and ensure everything is fine. Thank God there was no any successful attack to have access to sensitive data. I wasn't well aware of the situation until night but glad we are back and stronger.

[DYING_S0UL]

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

[robelneo]

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

I contacted my host about these patches, and they gave me a link to their updates about these vulnerabilities

All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities. Thank you for your understanding.

https://www.namecheap.com/help-center/live-chat/

According to WIZover 1.3 million websites were directly exposed

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

Yes, it can be compromised through phishing and man-in-the-middle (MITM) attacks

[IjawMan]

I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

True it was not a problem targeted to the forum alone but on all websites server that is running on PHP version.

For the first time too, I thought it was an attack on forum directly ontil I had to walk through about it and there I got to know how much the vulnerability effect spreads beyond the Bitcointalk. 

Powering down the forum was for the right thing to do and I'm happy Admin did it asap followed with necessary patches.

[snipie]

True it was not a problem targeted to the forum alone but on all websites server that is running on PHP version.

For the first time too, I thought it was an attack on forum directly ontil I had to walk through about it and there I got to know how much the vulnerability effect spreads beyond the Bitcointalk.  

Powering down the forum was for the right thing to do and I'm happy Admin did it asap followed with necessary patches.

The first time I heard about it was in the news when I saw them reporting that many government services were shut until the problem is solved. So seeing Bitcointalk down wasn't surprising too for me but it gives strange feelings to not be able to join.
Any idea how many forum members changed their passwords recently?

[Cricktor]

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?

Terrible idea in my opinion when there's no good evidence of a security and/or database breach and leak of data. Well, it doesn't hurt to change your password and if you feel safer to do it, then do it. But forcing everybody without strong reasons? No thank you!

I'm quite confident that theymos spent considerable time to investigate if a breach could've happened. From his wording, I'd say, chances for a breach were not likely to have happened. I assume the forum server(s) log one-way to a separate log collecting server which isn't exposed to the internet and isn't likely to become compromised should a hacker manage to compromise the forum's webserver(s). It should not be possible to tamper the logs (in an ideal world).

I've a complex and unique password generated by my password manager, 2FA is enabled here. I will have a closer look at the IP logs of my account in the next days and weeks and that's it. I could change my password, but I don't really feel the need to do it. YMMV!

Other services have already activated this type of feature after security breaches.

Makes sense after a security breach is confirmed.

[Welsh]

Any idea how many forum members changed their passwords recently?

You can check: https://bitcointalk.org/seclog.php

Basically anyone on / after 21st.

The first time I heard about it was in the news when I saw them reporting that many government services were shut until the problem is solved.

Here in the UK, there's still some not online yet or have just come online today.

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?

If there was proof of a compromise...maybe. Although, since theymos believes its unlikely anything was compromised I don't think we need to force users to change passwords, its up to their discretion.

[OgNasty]

I can't seem to update mine.  It won't accept "4" as a valid password.