www.retroservers.net

Server operators, please be advised. There is an exploit in the wild compromising SourceBans web installs affecting the last pre-PHP 8.1 version 1.6.4 and the new PHP 8.1 branch up until the version 1.7.0 released with the security patch yesterday.

The attacker is able to compromise the installation by spoofing a successful OpenID login with a different admin account. Depending on the account compromised, this privilege escalation may allow for rcon access via the rcon console, therefore you should assume your rcon password has been compromised. Users may also be added/edited/removed if the compromised account has web panel admin access. Existing user email addresses may also be viewed.

Please note PHP 8.1 must be installed on your web server to run the SourceBans version 1.7.0 that includes the security patch. This also requires updating Composer dependencies, one of which requires PHP to have the Sodium extension.

Update to the latest release here: https://github.com/sbpp/sourcebans-pp/releases/tag/1.7.0