Upgrade your CMS-MS installs and watch for hacks

[skypanther]

Hi all, I've had a few of my CMS-MS sites hacked over the past few weeks. All have been hit with hosting phishing scam files, uploaded to various folders in the /uploads/ directory. These have all been sites running older versions of CMS-MS that I hadn't yet had the time to update.

1) Upgrade your version of CMS-MS to the latest version immediately.
2) If you're running Apache, consider using the .htaccess file described in the wiki.
3) Watch your uploads directory for extraneous files (html and php files, plus subfolders of images/scripts/etc.). Delete them.

This is surely my fault. As I said, these are sites I hadn't gotten around to updating. I'm certainly not blaming anyone involved with developing CMS-MS. I urge you to update your CMS-MS sites right away to prevent such attacks.

Tim

PS: These incidents have given me the opportunity to speak with some very "nice" security officers at some fairly large banks around the world. Fun stuff to deal with on your day off, let me tell you!