I wanted to provide a quick explanation for the recent downtime on Morning Big Blue.
On October 21, two critical security vulnerabilities were publicly disclosed in PHP, the programming language used by our forum software and a significant portion of the internet. Collectively known as PHP2Shell, these vulnerabilities could potentially allow attackers to execute malicious code on vulnerable servers without needing to log in.
For anyone interested in the technical details, Cloudflare has a good explanation of the vulnerabilities and the steps being taken to protect websites:
After learning about the vulnerabilities, I made the decision to take MBB offline as a precaution until I could update the server's PHP environment to a patched version.
Rather than leave the site exposed while waiting for an opportunity to perform the updates, I felt it was better to accept some downtime.
Was MBB hacked?
At this point, I have no evidence that MBB was compromised or that any member information was accessed.
However, I have not conducted a comprehensive security forensic audit, so I cannot definitively rule out the possibility of unauthorized access. I don't want to suggest that a breach occurred, but I also don't want to make guarantees I cannot substantiate.
A reminder about password security
As a general precaution, if you use the same password on MBB and other websites, I would encourage you to change those passwords, particularly on any accounts where you have reused them.
This isn't because I have evidence that MBB passwords were stolen. It's simply good security practice.
A few recommendations:
Use a unique password for every website.
Consider using a password manager to generate and store strong passwords.
If you've reused your MBB password elsewhere, change it on those other services as well.
How widespread is this issue?
This isn't an issue specific to MBB, our forum software, or our hosting provider.
PHP is one of the most widely used programming languages on the web. It powers everything from small personal websites and discussion forums to major content management systems, online stores, and large commercial applications.
What makes these vulnerabilities particularly serious is that they exist in PHP itself, rather than in a specific website or application. That means even a website with fully updated application software could potentially be vulnerable if the underlying PHP installation hasn't been patched.
The vulnerabilities have been rated 9.2 out of 10 for severity, and emergency security updates have been released.
Security companies and hosting providers around the world have been responding, including Cloudflare, which deployed protective firewall rules. However, those protections are not a substitute for installing the actual PHP security updates.
The scale of the potential exposure is substantial. Millions of websites depend on PHP, although that doesn't mean every PHP website was vulnerable or compromised.
This is a good reminder that even well-maintained websites depend on software components that can occasionally have serious security issues. Keeping systems updated, applying security patches quickly, and taking precautionary measures are all part of operating a website responsibly.
Moving forward
I've applied the available security updates and verified that MBB is running on a patched PHP environment.
I apologize for the interruption, but given the severity of the vulnerabilities, I believe taking the site offline temporarily was the responsible decision.
I wanted to provide a quick explanation for the recent downtime on Morning Big Blue.
On October 21, two critical security vulnerabilities were publicly disclosed in PHP, the programming language used by our forum software and a significant portion of the internet. Collectively known as PHP2Shell, these vulnerabilities could potentially allow attackers to execute malicious code on vulnerable servers without needing to log in.
For anyone interested in the technical details, Cloudflare has a good explanation of the vulnerabilities and the steps being taken to protect websites:
Cloudflare: Protections Against the PHP2Shell Vulnerability
Why MBB was taken offline
After learning about the vulnerabilities, I made the decision to take MBB offline as a precaution until I could update the server's PHP environment to a patched version.
Rather than leave the site exposed while waiting for an opportunity to perform the updates, I felt it was better to accept some downtime.
Was MBB hacked?
At this point, I have no evidence that MBB was compromised or that any member information was accessed.
However, I have not conducted a comprehensive security forensic audit, so I cannot definitively rule out the possibility of unauthorized access. I don't want to suggest that a breach occurred, but I also don't want to make guarantees I cannot substantiate.
A reminder about password security
As a general precaution, if you use the same password on MBB and other websites, I would encourage you to change those passwords, particularly on any accounts where you have reused them.
This isn't because I have evidence that MBB passwords were stolen. It's simply good security practice.
A few recommendations:
Use a unique password for every website.
Consider using a password manager to generate and store strong passwords.
Enable two-factor authentication wherever it's available.
If you've reused your MBB password elsewhere, change it on those other services as well.
How widespread is this issue?
This isn't an issue specific to MBB, our forum software, or our hosting provider.
PHP is one of the most widely used programming languages on the web. It powers everything from small personal websites and discussion forums to major content management systems, online stores, and large commercial applications.
What makes these vulnerabilities particularly serious is that they exist in PHP itself, rather than in a specific website or application. That means even a website with fully updated application software could potentially be vulnerable if the underlying PHP installation hasn't been patched.
The vulnerabilities have been rated 9.2 out of 10 for severity, and emergency security updates have been released.
Security companies and hosting providers around the world have been responding, including Cloudflare, which deployed protective firewall rules. However, those protections are not a substitute for installing the actual PHP security updates.
The scale of the potential exposure is substantial. Millions of websites depend on PHP, although that doesn't mean every PHP website was vulnerable or compromised.
This is a good reminder that even well-maintained websites depend on software components that can occasionally have serious security issues. Keeping systems updated, applying security patches quickly, and taking precautionary measures are all part of operating a website responsibly.
Moving forward
I've applied the available security updates and verified that MBB is running on a patched PHP environment.
I apologize for the interruption, but given the severity of the vulnerabilities, I believe taking the site offline temporarily was the responsible decision.
Thanks for your patience and understanding.