On November 4th there was a security incident where someone found a way to upload a malicious Flash post. Since then the site has been down for a week while we responded. This is what happened.
The short version is that someone found an exploit that let them upload a Flash file that contained an XSS worm. The worm tried to spread itself across the site and steal the IP address of anyone viewing the infected posts. The site was shut down within about 6 minutes, so the actual damage was very limited. The main thing it did was grab the IPs of anyone who viewed the posts.
The exploit itself was quickly fixed, but it was clear that the attacker had used LLMs to find this exploit, and that they were targeting us and would use LLMs to find other exploits if we brought the site back up too soon. So we spent the next week fixing every security issue we could find and generally beefing up security to make sure this kind of thing couldn't happen again. We also used the downtime to do some much-needed server maintenance and upgrades that we had been putting off for a long time, which also took a couple of days.
What happened?
An attacker uploaded a malicious Flash post that, among other things, grabbed your IP address and hijacked your account to spread the file.
The servers themselves weren't hacked, and the file itself didn't hack your computer or anything like that. It just let the attacker take over your account while you were viewing an infected post. It only affected those who viewed it in the 6-minute window the site was up.
What exactly did it do?
This is what it did:
- First it showed a video from hxxps://domain2doamin.duckdns.org/cdn/worm-video.flv. This grabbed your IP address (this is the attacker's site, so don't visit that site without a VPN, it's an IP grabber).
- If you were a logged-in user, it would log your username, so it would get your username and IP.
- Next it tried to create a backdoor API key for your account.
- This only worked if you had entered your password in the last hour. It was only able to do this for 7 people who had recently logged in. These API keys were never used and have been deleted.
- Next it used your account to post copies of itself, upvote other copies of itself, and post links to itself in the forum.
- If you were an approver level user, it would also approve copies of itself.
- If you were a moderator, it would try to harvest the email addresses of users. It also tried promote other accounts.
- Neither of these things worked because the site was shut down before any mods had their accounts hacked.
- Lastly, it tried to delete all your favorites. These have been restored.
Who was affected?
- The infected posts got about 600 page views. Not all of these views actually triggered the worm.
- About 300 people actually ran the worm. 200 of them were logged out and 100 logged in.
- The 200 logged-out users had their IPs harvested.
- The 100 logged-in users had their username and IPs harvested, and had their accounts temporarily hijacked to spread the worm.
- 48 users had a total of 1000 favorites deleted. These have been restored.
- 7 users had backdoor API keys created. These have been deleted.
- 68 copies of the worm were posted. They have all been deleted.
- The infected posts were upvoted a total of about 5000 times.
- 129 forum posts were created to help spread the worm.
How did they upload it?
The ability to upload Flash files was disabled in 2021. It was accidentally enabled again after the upload process was reworked in 2022. But you still couldn't upload Flash files, because another bug prevented it.
On 2026-10-28, someone submitted a pull request to fix a bug that uploads would fail if they couldn't generate thumbnails. It turned out that this was the attacker, and that by fixing this bug we were inadvertently allowing Flash files to be uploaded again.
The pull request itself didn't contain any malicious code. It was a genuine one-line fix for a genuine bug. The problem was that unbeknownst to us, the bug it was fixing was the only thing preventing Flash files from being uploaded.
What went wrong?
It was a chain of failures:
- The test suite wasn't thorough enough. When Flash uploads were first disabled, a test wasn't added to verify that they were disabled. Then when they were accidentally enabled again, it went unnoticed.
- We didn't sandbox the Ruffle player used for playing Flash videos. We didn't do this because we didn't recognize the need for it at the time, since new Flash uploads had already been disabled.
- We got social engineered into accepting a malicious pull request.
- The biggest one was: we weren't using LLMs to audit the codebase soon enough. Attackers adopted LLMs to look for exploits faster than we did, and we had to catch up fast. In the last six months or so AI has gotten really good at finding exploits, to the point where now people with no knowledge can pull off exploits that in the past would haven taken a lot of expertise.
How do I make sure my account is secure?
There is no reason to believe anyone's accounts have been hacked. But if you want to be sure:
- Go to your Settings page.
- Click "Security".
- Change your password.
- Enable two-factor authentication (2FA).
- Check your login history for anything suspicious.
- Go to your Profile page, click on API keys, and check for any you don't recognize.
Again, the servers themselves weren't hacked and there are no indications any accounts have been persistently compromised. But it doesn't hurt to check your account and enable 2FA.
Updated by evazion
