Hi folks!
There were several major security flaws in the news this past week. Most of them are irrelevant to LolCollective, but one of them could theoretically pose a risk. With that said, Shivers has gone explicitly looking and sees no sign of a breach.
Vulnerability nickname: PHP2Shell.
Risks to you: Again, as far as I can tell, there is no security breach at present specific to LolCollective. In addition, we do not retain any data that we do not need to; what we don't know can't be stolen. We have your e-mail address, the password you use here, and your profile picture, plus logs of any IP address and browser you have connected with on a 7-day-rolling basis.
What's the vulnerability: For all versions of PHP used since 2012 until this week, there was a scenario where if PHP crashed in just the right unusual way, a bad actor could then use that crash to upload and run code to the server. That includes LolCollective's code itself, as well as a major partner Cloudflare, a service which helps to provide faster loading times in other countries. Unfortunately, an estimated 70% or so of the internet is affected by this.
Timeline of the LolCollective response:
- Oct 17:
- Vulnerability announced.
- Shivers updated all plugins and software on the site to the most recent version to mitigate risks. At that time, we were running PHP version 8.4.25, which was released two months ago.
- Our hosting provider installed a temporary fix to block unauthorised access. You may or may not have had to log in again (whether you did or not makes no difference, you were protected either way).
- Oct 19:
- LolCollective underwent a short bot-attack around 6AM EST (Canada/US), with about 2,000-3,000 additional login requests compared to normal. This is a fairly common occurence that all websites based on wordpress deal with; we have standard precautions in place. There are no obvious signs of any breaches to any individual account or accounts, and no accounts attempted anything malicious. It's nearly certainly unrelated to the vulnerability, but is shared here in the spirit of transparency.
- At around 1PM EST, there were six attempts to upload and run malware on the site. Those six attempts were all blocked. I've checked the file logs, which show no uploads of any type took place on that date (not even memes, coincidentally)!
- Oct 21:
- The PHP Group (the folks who own the vulnerable code language) released a patch that blocks this exploit.
- Our hosting provider installed the patch across their network (PHP 8.4.27), including on this website. Our hosting provider states that they were monitoring steadily between the 17th and 21st, and to their knowledge no unauthorised access took place. They are continuing to monitor.
- Oct 23:
- Shivers updated the site's PHP version from 8.4.27 to 8.5.12. Both are equally secure against this vulnerability, this was done for future-proofing only.
- I have gone through the error logs from the 16th-today, as well as the site traffic logs for the 17th-19th, down to the line-by-line level towards the end, looking for any signs of unauthorised access or breach of our databases, and I do not see anything of concern.
With that said: there is no way to conclusively prove that no one used this exploit, say, 5 years ago... or 20 years ago... the risk is microscopic, but not zero, and that's why the entire IT industry is freaking out. For now, the usual advice applies: use long passwords, with a different one for each website, and change them if there is ever a known or suspected breach.
Right now, to belabour things one final time: there is no known breach on LolCollective. Even the password you use here should be safe, but can not be guaranteed to be safe. So, if you use the same password for your bank or anything, well.. maybe change it, just in case.
Be well! <3