threatpost.com Savannah GNU Site Compromised in SQL Injection Attack
Article Content
- •Savannah GNU site compromised via SQL injection, exposing encrypted passwords.
- •Attackers accessed restricted project materials, leading to potential unauthorized access.
- •Site remains offline while security measures are restored and users are advised to recommit changes.
The Savannah GNU free software archive was compromised due to a SQL injection attack, resulting in the exposure of encrypted passwords and unauthorized access to project materials. The attack occurred within the last couple of days, and the site remains offline as the team works on restoring security measures. A notice from the group indicated that some passwords were accessed through brute-force methods, leading to potential project membership access. The site is part of the Free Software Foundation and hosts various GNU-based projects. While the site is being restored from a clean backup, users are advised to prepare to recommit their changes since November 23rd. The group acknowledged past efforts to fix vulnerabilities in the legacy codebase but stated that these measures were insufficient.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Apache Software Foundation in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What should users do now?
What vulnerabilities were exploited?
Is there a timeline for full site restoration?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…