DefectiveWings βοΈ
nixCraft π§heads up: FreeBSD forums hacked. Be caeeful with your email or DMs coming from FreeBSD forum or freebsd{.}org for some time now.
https://forums {.} freebsd {.} org/
Bill
Aaron Toponce βοΈ
@nixCraft Aside from defacement, what's the extent of the hack? Usernames and passwords leaked?
@atoponce no idea. we have to wait and see.
pete@atoponce @nixCraft the hack looks to just be a defacement currently. the defacement is just links to this repository:
https://github.com/cassbethany10-afk/test123
which just has some syn flooders and whatnot. unlikely to be anything sophisticated.
@atoponce @nixCraft also they decided to change who it was hacked by shortly after making the defacement page
@atoponce @nixCraft looks like the forums are back down???
https://fosstodon.org/@xinayder/116319094022309675
^ this fedi post seems to imply (to me) it was just stored XSS?
Alex (@[email protected])
Attached: 1 image they added widgets to what seems to be the "Whats New" section of the forums, which load the replacement web page:
TomAoki@nixCraft @novet @atoponce
Anyway, the DNS entry for forums.freebsd.org seems to be removed currently.
% drill forums.freebsd.org @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 46711
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; forums.freebsd.org. IN A
;; ANSWER SECTION:
forums.freebsd.org. 60 IN A 127.0.0.1
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 13 msec
;; SERVER: 1.1.1.1
;; WHEN: Tue Mar 31 03:04:59 2026
;; MSG SIZE rcvd: 52
The answer could be because of local_unbound (running at 127.0.0.1 [localhost]).
For some (running) others and parent entry:
% drill freebsd.org @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 40850
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; freebsd.org. IN A
;; ANSWER SECTION:
freebsd.org. 3600 IN A 96.47.72.84
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 18 msec
;; SERVER: 1.1.1.1
;; WHEN: Tue Mar 31 03:05:34 2026
;; MSG SIZE rcvd: 45
% drill bugs.freebsd.org @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 53700
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; bugs.freebsd.org. IN A
;; ANSWER SECTION:
bugs.freebsd.org. 60 IN CNAME web3.nyi.freebsd.org.
web3.nyi.freebsd.org. 3600 IN A 96.47.72.106
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 35 msec
;; SERVER: 1.1.1.1
;; WHEN: Tue Mar 31 03:06:29 2026
;; MSG SIZE rcvd: 73
% drill www.freebsd.org @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 36543
;; flags: qr rd ra ; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; www.freebsd.org. IN A
;; ANSWER SECTION:
www.freebsd.org. 10 IN CNAME web.geo.freebsd.org.
web.geo.freebsd.org. 150 IN A 192.50.199.250
web.geo.freebsd.org. 150 IN A 210.231.212.93
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 174 msec
;; SERVER: 1.1.1.1
;; WHEN: Tue Mar 31 03:06:02 2026
;; MSG SIZE rcvd: 87
@atoponce @nixCraft not sure about the XSS actually but i literally just have a phone and a BSD laptop which can't find the network interface (hence why i was looking at the forums) so couldn't do any proper investigation. hopefully the admins can get it up and running and the damage is only surface level.
Neil E. Hodges
bazkie π©πΌβπ» bitplanes π΅
ΤΡΞ·Ο
ΠΊΞΉ, ζζγππ§β π β«βͺ@nixCraft
source url of this news ?
source url of this news ?
@nixCraft @enigma If you go to the FreeBSD forums, you get this.
β² f.kawa-kun.com/display/881761aβ¦
β² f.kawa-kun.com/display/881761aβ¦
@enigma @nixCraft as far as i've seen, it's only been mentioned on this mailing list:
https://lists.freebsd.org/archives/freebsd-chat/2026-March/000075.html
so far. don't think there has been any official response as of yet.
@enigma @nixCraft there is this fedi post where someone claims they spoke on IRC. i haven't got a computer with me to check
Alex (@[email protected])
got reply from IRC that the server admins are aware of the issue. hopefully it's just a defacement and no data was exfiltrated!
Luna / Miika β 
(need more cuddles)
hazelnot 
@hazelnot
you may have noticed I didnot have to see it. There are helpful people who don't say " see for yourself". Those I have to thank what I did.
you may have noticed I didnot have to see it. There are helpful people who don't say " see for yourself". Those I have to thank what I did.
Ray McCarthy@nixCraft
Oh dear. :(
Just the forums? The packages & manuals not affected?
Richard
ΔΓKΓπ»π»β’@nixCraft whatever I want to start gets destroyed. βΉοΈ π.. Was thinking to start Linux but now many distro going to implement age verification... Was thinking to use bluesky they Goin to use AI. Was thinking to use FreeBSD and shared video 2 days ago now this hacking news. Wath a lucky person I'm. π
cynical melomaniac 
@nixCraft That's incredibly rude.
caveknoll