NYCPHP Meetup

[Tim Gales]

> It looks like I got slammed by some new PHP vulnerablity. It first 
appeard 
> that what it did was to replace all your index pages with its own 
that 
> proclaims "This site is defaced!!!" and then 
includes ... "NeverEverNoSanity 
> WebWorm generation 8.".
> 
> Well, in an effort to fix this problem, I completely rebuilt apache, 
> mod_ssl, and PHP. And when I tried to upload new index files from my 
backup, 
> I still get the damn messages but it is as if thay are overlaid on 
top of my 
> regular pages. So Weird...
> 
> Anyone have any information about this...

>From what I have read there is a script 
which uses Google to find vulnerable sites 
like yours.

It could happen that after you totally redo 
your site, you can systematically get compromised 
again in short order.

I would consider changing default directories 
and renaming configuration files.

Tim G.