<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>okaaay, I fortunately haven't installed it... :-p<br>
</p>
<p>Talking about CMS, I installed <b>Joomla</b> from the BlueOnyx
Shop (Software Updates > Third Party Software > loupe), but
afterwards, I don't know how to proceed...</p>
<p>I found a bunch of Joomla files in /home/webapps/joomla, but
those aren't accessible from the web of virtual sites. And MySQL
has to be configured, too.</p>
<p>Where can I get instructions?</p>
<p>Thank you and best regards
</p>
<table cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td rowspan="2" style="font-family:monospace;" valign="top"
width="20"><small><tt>_~_<br>
'¿')<br>
`-´</tt></small></td>
<td> Meaulnes Legler</td>
</tr>
<tr>
<td valign="top"><small> Zurich, Switzerland</small></td>
</tr>
<tr>
<td colspan="2">+41\0 44 260 16 60</td>
</tr>
</tbody>
</table>
<br>
<p> </p>
<br>
<div class="moz-cite-prefix">On 24.04.18 00:09, Michael Stauber
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:c8afc776-1965-7bcb-0c1e-5b69a8383612@blueonyx.it">
<pre wrap="">Hi all,
I'll probably be preaching to the choir on this list, but I'll say it
anyway:
If you're running Drupal on any Vsite on your server then you should
consider to suspend or delete that Vsite right now.
If it's a paying customer ask him to get his own server. Preferably
elsewhere.
How complicated is it to turn a Drupal 7 instance into a crypto miner
that uses 90% of the servers CPU power?
A *single* POST request via the web.
Please let that sink in.
And yes, by now there are botnets spreading the infection like wildfire.
Still think it's a good idea to run something on your server that has
such a terrible track record as Drupal has? They will *NEVER* get
security right. Not in a million years. Forget it.
The vulnerability I'm talking about is this one:
<a class="moz-txt-link-freetext" href="https://www.drupal.org/sa-core-2018-002">https://www.drupal.org/sa-core-2018-002</a>
<a class="moz-txt-link-freetext" href="https://thehackernews.com/2018/04/drupal-cryptocurrency-hacking.html">https://thehackernews.com/2018/04/drupal-cryptocurrency-hacking.html</a>
<a class="moz-txt-link-freetext" href="https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know">https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know</a>
But it's just *one* in a long list of similar happenstances. So,
seriously: Ditch it. Burn it with fire and nuke it from orbit.
What about the latest version of Drupal? Forget that as well. Because
your user won't update their Drupal installs and neither will you.
Because if it's a pain in the gluteus maximus to update, nobody will.
And sadly: That says as much about Drupal as their long and shitty
security track record, which go hand in hand there.
/rant mode off. ;-)
And yes: I just had to cleanup a BlueOnyx that was hacked that way.
Writing the forensic report on it took longer than the actual cleanup,
though. \o/
</pre>
</blockquote>
<br>
</body>
</html>