While I was asleep, apparently the site was hacked. Luckily, (big) part of the
lemmy.world team is in US, and some early birds in EU also helped mitigate this.
As I am told, this was the issue: - There is an vulnerability which was
exploited - Several people had their JWT cookies leaked, including a...
It looks like several Lemmy instances were exploited last night. It doesn't appear that much damage has been done, but users may have to log out and back in if they use mobile apps.
@[email protected] have you found any indication that lemmy.cafe may have been targeted too?
I've checked the admin activity, the logs - nothing suspicious.
I've also found the description of the vulnerability - it was an XSS attack abusing custom emojis.
I have never added any. I have also checked the database and there are no custom emojis on this instance. Everything appears to be fine for now. Will update to the fixed release as soon as it's available.