After getting reports today about WordPress installs getting hacked on the server I did some investigating and found that this may be a server wide hacking, meaning potentially all WordPress installs may have been defaced on the server.

The exploit was mostly likely caused by a vulnerability in Apache having to due with symlinks.

If you were effected by this, I have wrote the following article to help you: http://vlexofree.com/wiki/Exploit:_Hacked_by_badi

I have also recompiled apache/php with a patch to prevent the exploit (although the patch may cause issues of its own) and globally changed everyone’s “wp-conf.php” to “600″ permissions.

The exploit did not compromise your overall WordPress install or your passwords. The only changes made by the exploit are to the wordpress database in the following locations: the wordpress title, charset, and widgets. It only takes a few steps to fix, but it is a bit annoying to have to do it.

If anyone noticed (hopefully you didn’t since the downtime was only about 5 minutes), the server was rebooted at around 12:30am PDT today.

First I’ll start off with the bad news…. which is that the server’s uptime has gone from 176 days of being continually online, back down to 0 days. Looking at the graph below it is a sad sight indeed.

If you look at the far right you can see the emptiness of the drop to 0 days.

But! With all good things comes consequences. Which leads me to the Good News!

The reboot was not pointless, but required so we could boot into an updated kernel that fixed multiple security issues, address several hundred bugs, and added numerous enhancements. Exciting, right?

I thought I would let everyone know that I have just replaced cPanel’s old PHP configuration file with one designed for PHP 5.4. This should lead to some performance improvements for PHP scripts.

If you’re having any issues with you scripts that weren’t there before, be sure to post your issue in the VlexoFree Support Forum.

Note: My next project, once I have time, is to update to Apache 2.4 and resolve any issues that might cause.

The servers version of PHP has just been updated to 5.4.13 from the previous version of 5.3.22 we had before. This new version brings a bunch of changes to PHP.

If you would like more info about the changes, take a look at the Migrating from PHP 5.3.x to PHP 5.4.x page on PHP.net.

For the first time in a while the server has had some major downtime.

Basically at 7:30am PST the server’s internet connection went offline and unfortunately I was asleep until about 10:30. So, when I woke up to see the server down I contacted upstream support and they replaced a faulty ethernet cable on the server.

About 3 hours downtime total; and I’m very sorry for any inconvenience.

-Eli L