Just rebuilt one of my Discourse forums and when I load it in the browser, the following message shows up in a popup: You’ve been hacked by a plugin! by w3shi(Hackerone)-S.Lakshmi Vignesh(RCE-POC) Holy… What is going on? One of the plugins I use was compromised?

Indeed, @RGJ is now back in control of the github organization, so we’ve removed the temporary error message.

Any chance you used the migrate password plugin? Or another plugin from the discoursehosting repository? [תמונה] You've been hacked Discuter entre Dolibarriens Bonjour, En effet, cela était en lien avec la dernière mise à jou…

[תמונה] Moin: Any chance you used the migrate password plugin? Or another plugin from the discoursehosting repository? Yes, it’s in the list. And the only one from discoursehosting. I remember that it needs to be active to allow “old” users to login, correct? But now the question is more if…

just remove anything referring to discoursehosting

Google Translate of the French forum post: A pseudo-security researcher retrieved an old Git repository for a plugin used by the forum and hijacked it to simply display this message. The repository in question (GitHub - discoursehosting/discourse-migratepassword: A touch of security) has been ins…

TL;DR This is a Github vulnerability in an exploit class called “Repojacking”. We recommend everyone to check their Github plugin URLs and rename each and every instance of discoursehosting to communiteq Background: We had to rename our company from Discoursehosting to Communiteq in 2019. If that…

[תמונה] Roi: But now the question is more if the installation was compromised or if it’s just showing this message At this moment the compromised plugin only shows a message and leaves a harmless file in /tmp. So nothing bad has happened - yet. It is important to change your plugin URL befor…

[תמונה] RGJ: Repojacking wow it can catch the end user out easily, one of the main disadvantages of not using discourse.org official hosting. If either angusmcleod (Angus McLeod) · GitHub or merefield (Robert) · GitHub accounts ceased to exist then a first sub-path would be exposed, so th…

To mitigate the potential impact for users of the standard install , we’ve added code to detect github.com/discoursehosting/ and abort any rebuilds/upgrades. Fail rebuild for config files containing compromised github organisat… · discourse/discourse_docker@7889fe3 · GitHub Fail rebuild for con…

Hello Discourse community, I want to sincerely apologize for the disruption caused by my actions regarding the plugin repository. In attempting to highlight a security issue, I made serious mistakes that violated the code of conduct. Going forward, I will ensure my actions adhere to responsible di…

נפרצת על ידי תוסף

תמיכה

Lilly (Lillian ) 17 ביולי,‏ 2025,‏ 9:04pm 4

פשוט הסר כל דבר המתייחס ל-discoursehosting

נושא		תגובות	צפיות
Installation Error when rebuilding with Discourse Official Plugins (Discourse v2.0.3) Self-hosting solved	7	2671	16 באוגוסט,‏ 2018
Forum not working after update – what’s missing? Self-hosting	35	627	4 בספטמבר,‏ 2025
Check plugin or theme validity Support	14	1493	30 בדצמבר,‏ 2019
Deprecated plugins after update? Self-hosting	3	357	23 בנובמבר,‏ 2023
Github integration for Discourse hosted Support	1	437	8 בספטמבר,‏ 2021

נפרצת על ידי תוסף

נושאים קשורים