About the php2shell issue

[Shishir99]

PGP is better than PHP!

Welcome back, nullius!

What if OpenAI somehow manage to find vulnerabilities in PGP as well?
The AI is scary as fuck now. I heard that a newer model AI can find many old bugs that has been around for a long time and never exposed before. However, I was able to verify your signed message using bitmover's pgp verifier tool - Verified ✅, Anyone should be able to verify using this dedicated link.

Welcome back again.

[Comeacross]

I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

Regardless, the forum admin did well to swing into action quickly and ensure everything is fine. Thank God there was no any successful attack to have access to sensitive data. I wasn't well aware of the situation until night but glad we are back and stronger.

[DYING_S0UL]

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

[robelneo]

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

I contacted my host about these patches, and they gave me a link to their updates about these vulnerabilities

All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities. Thank you for your understanding.

https://www.namecheap.com/help-center/live-chat/

According to WIZover 1.3 million websites were directly exposed

Probably, no action is required for most people. If you want to be extra safe, it wouldn't hurt to change your password (mainly just to invalidate all of your sessions).

Does that include resetting 2FA as well? Can it also be compromised anyhow?

Yes, it can be compromised through phishing and man-in-the-middle (MITM) attacks

[IjawMan]

I really don’t know why attack will be coming to this forum, I’m just happy nothing went wrong, I know the forum is safe and okay always in your hands.

It actually takes smart individual to handle this forum as an admin.

The attack is not specifically targeting the forum. It's a general vulnerability in PHP itself. Any site running on it could be affected, not just this forum. Going offline was a precaution to put things on check.

True it was not a problem targeted to the forum alone but on all websites server that is running on PHP version.

For the first time too, I thought it was an attack on forum directly ontil I had to walk through about it and there I got to know how much the vulnerability effect spreads beyond the Bitcointalk. 

Powering down the forum was for the right thing to do and I'm happy Admin did it asap followed with necessary patches.

[snipie]

True it was not a problem targeted to the forum alone but on all websites server that is running on PHP version.

For the first time too, I thought it was an attack on forum directly ontil I had to walk through about it and there I got to know how much the vulnerability effect spreads beyond the Bitcointalk.  

Powering down the forum was for the right thing to do and I'm happy Admin did it asap followed with necessary patches.

The first time I heard about it was in the news when I saw them reporting that many government services were shut until the problem is solved. So seeing Bitcointalk down wasn't surprising too for me but it gives strange feelings to not be able to join.
Any idea how many forum members changed their passwords recently?

[Cricktor]

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?

Terrible idea in my opinion when there's no good evidence of a security and/or database breach and leak of data. Well, it doesn't hurt to change your password and if you feel safer to do it, then do it. But forcing everybody without strong reasons? No thank you!

I'm quite confident that theymos spent considerable time to investigate if a breach could've happened. From his wording, I'd say, chances for a breach were not likely to have happened. I assume the forum server(s) log one-way to a separate log collecting server which isn't exposed to the internet and isn't likely to become compromised should a hacker manage to compromise the forum's webserver(s). It should not be possible to tamper the logs (in an ideal world).

I've a complex and unique password generated by my password manager, 2FA is enabled here. I will have a closer look at the IP logs of my account in the next days and weeks and that's it. I could change my password, but I don't really feel the need to do it. YMMV!

Other services have already activated this type of feature after security breaches.

Makes sense after a security breach is confirmed.

[Welsh]

Any idea how many forum members changed their passwords recently?

You can check: https://bitcointalk.org/seclog.php

Basically anyone on / after 21st.

The first time I heard about it was in the news when I saw them reporting that many government services were shut until the problem is solved.

Here in the UK, there's still some not online yet or have just come online today.

I've been thinking... would not be a good idea to somehow "force" all users to change their pass?

If there was proof of a compromise...maybe. Although, since theymos believes its unlikely anything was compromised I don't think we need to force users to change passwords, its up to their discretion.

[OgNasty]

I can't seem to update mine.  It won't accept "4" as a valid password.

[libert19]

I'm quite confident that theymos spent considerable time to investigate if a breach could've happened. From his wording, I'd say, chances for a breach were not likely to have happened.

(referring to italic part) Lol. People be confident no matter what, and when online use convincing wording, and people will believe ya!

^ I am just sayin, it's good to trust those who are transparent, trustworthy individuals as it being the case with theymos but this is precisely why it's easy to set oneself up for manipulation by behaviours, behaviours which can be faked.

Any idea how many forum members changed their passwords recently?

You can check: https://bitcointalk.org/seclog.php

Basically anyone on / after 21st.

Meanwhile, here was me who was checking third-party websites to check for security logs. Also, TIL that the different positions have different colors — how about reflecting same everywhere too? I think it would make forum look colorful!

I can't seem to update mine.  It won't accept "4" as a valid password.

Have you tried other digits?

Edit: security modlogs changed to security logs.

[eldentyrell]

I can't seem to update mine.  It won't accept "4" as a valid password.

I ran into such warning message few times. But it eventually went through for me. And mine had a "4" in it too!
Not sure why it's refusing on your end. It might be worth submitting it couple more time to see if it stick or not.

[Supreme Donvic]

...how will you feel after a week without bitcointtalk forum?

LOL, everyone on Bitcointalk forum is working, people have a life outside this forum, right now I'm writing this post in my office because I'm done with my job for today and I will be going back home very soon.
People that are very active on this forum still have a job, the only reason why they may be very active on this forum is because their job is not that stressful and it gives them so much time.

I was not expecting this answer, you are funny .

[IjawMan]

^^

^^
Any idea how many forum members changed their passwords recently?

No idea. Am only concentrated on my own account so I wouldn't know about any passwords changes done by others resulting from what had happened.

Maybe https://bpip.org can help you  with that knowledge..

[acroman08]

No idea. Am only concentrated on my own account so I wouldn't know about any passwords changes done by others resulting from what had happened.

Maybe https://bpip.org can help you  with that knowledge..

I don't think bpip.org can help. They do have this "https://bpip.org/metalog.aspx?d=2026-10-24", but from the looks of it, it doesn't show accounts that changed their password. Anyway, Welsh already shared this "https://bitcointalk.org/seclog.php", which is just several posts above yours, it shows accounts that made changes to their password, 2FA, and accounts that woke up.

[LoyceV]

Any idea how many forum members changed their passwords recently?

You can check: https://bitcointalk.org/seclog.php

If you want to compare with older data: see my seclog log.

[Lucius]

Considering the admin's warning, I thought that many more members had changed their passwords, but when you look at the sec log, it's a very small percentage of active members.

[TypoTonic]

Several attacks were attempted, but those particular attacks were blocked by Cloudflare, and also would've failed anyway due to certain configuration details.

I'm curious to know, were those attacks before or after the public disclosure? Apparently, there were already some attempts to exploit the vulnerabilities, even a few days before the leak.
More details here: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

Any idea how many forum members changed their passwords recently?

You can check: https://bitcointalk.org/seclog.php

If you want to compare with older data: see my seclog log.

There's also https://brdb.cc/explore by *Ace*. Just go to the Security tab and choose "Password Changed", it'll show the filtered list of users who changed their password recently.

[LTU_btc]

Considering the admin's warning, I thought that many more members had changed their passwords, but when you look at the sec log, it's a very small percentage of active members.

I admit that I'm one of these users who haven't done anything. theymos words that no actions isn't needed probably is the reason why not many people have done it. Changing password is more like extra action, not something must do.
I guess many users who don't visit Meta didn't even saw this announcement.

[theymos]

I'm curious to know, were those attacks before or after the public disclosure?

A bit before: the first was at 13:49 UTC.