While I was asleep, apparently the site was hacked. Luckily, (big) part of the
lemmy.world team is in US, and some early birds in EU also helped mitigate this.
As I am told, this was the issue: - There is an vulnerability which was
exploited - Several people had their JWT cookies leaked, including at least one
admin - Attackers started changing site settings and posting fake announcements
etc Our mitigations: - We removed the vulnerability - Deleted all comments and
private messages that contained the exploit - Rotated JWT secret which
invalidated all existing cookies The vulnerability will be fixed by the Lemmy
devs. Because not all instances are aware, we will not go into detail on the
vulnerability yet. Many thanks for all that helped, and sorry for any
inconvenience caused! Update While we believe the admins accounts were what they
were after, it could be that other users accounts were compromised. Your cookie
could have been ‘stolen’ and the hacker could have had access to your account,
creating posts and comments under your name, and accessing/changing your
settings (which shows your e-mail). For this, you would have had to be using
lemmy.world at that time, and load a page that had the vulnerability in it.
Yea, for me it depends a lot on the day how much time I spend here. Some days hours some days 0, so I might miss some stuff but hopefully the other 2 catch them or someone reports it to us.
Sören (he is the one that actually owns it) just replied to me, so should be sorted very soon. I guess one of us will update once its done (or you might notice the server going down for a restart).
The site is only vulnerable if you used custom emoji’s for this instance of lemmy. Otherwise you can ignore this.
We were using them. It should be resolved now however.