Recent hack on bonsai.php.net
| From: | RG | Date: | Wed, 31 Aug 2005 00:52:39 +0000 |
| Subject: | Recent hack on bonsai.php.net | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-29173@lists.php.net to get a copy of this message | ||
Dear PHP administrator,
As you are probably aware, bonsai.php.net was currently compromised. The so called hacker that
did this was leaked a CVS 0day (an unpublicized exploit). The two other people he worked with did
not have the intention to bring bonsai.php.net down, they were only looking for bugs, I think one of
them even submitted a bug report. However, the lone hacker, whose handle is pacifico thought it
would be cool to deface to bonsai.php.net. After gaining access to the CVS he started boasting about
backdooring PHP's source code, as well as php.net. He made his intentions clear, he wants to
achieve as much fame as possible by backdooring and defacing php.net. He also claimed to have ftp,
and ssh access to php.net. His IP is 24.163.93.176. I know all of this because he was chatting on my
IRC server, so I have logs.
If you have any further inquiries, you may contact me by replying or chatting me on AIM, my
screenname is ScriptBlue.
PS, I am revealing all of this information out of respect for such a great community of developers.