Hi everyone.

Lemmy had an XSS vulnerability and we were one of the instances attacked through this vulnerability. We had our homepage replaced by a youtube video.

The lemmy devs were quick to create a PR for this issue and we have patched our instance to fix it,

Also while I do not believe any login tokens were compromised, we have taken the additional measure of rotating our secret key, so everyone will have to login to the site again as your existing credentials will no longer be valid.

If login fails to work properly, you may have to clear your cookies for the site… it seems to get confused about whether you’re logged in or not.

Sorry that this happened, if you have any questions please contact @ada@lemmy.blahaj.zone or myself.

blobcat, heart

  • Erika2rsisEnglish
    8•10 months ago

    What sort of YouTube video replaced the home page? I’m assuming it was some sort of shock/racist content.

    • Kaity AOPMAEnglish
      7•10 months ago

      Not sure. I didn’t load it.

      • @flamingmongooseEnglish
        8•10 months ago

        Fairly harmless choice by the hacker, though could be a bit of a jumpscare if you’ve allowed autoplay for blåhaj zone

        • Paige (she/her)English
          6•10 months ago

          YouTube doesn’t allow you to embed music videos, so it wouldn’t play unless you clicked on it lmao.

    • Paige (she/her)English
      3•10 months ago

      Some music video titled “rap god” or something.