Community Stories

🚨ADMIN: Why we pulled Omegaforums offline for a day (Oct ’26)

dsio
Posts
35,752
Likes
40,033
We became aware of two CVE’s (Common Vulnerabilities and Exposures) of extremely serious severity impacting PHP, a software that 70% of the internet relies on, us included. https://www.php.net/archive/2026.php#2026-10-21-5

The announcement mentioned a patch due in just over a day, along with a full explanation of the exploit.

Due to the high rate of development of LLMs, and their ability to find attack vectors (especially once they know where to look), we did not believe the patch would arrive in time to protect the site.

We made the decision to bring the site down until the patch was available as a precaution to completely prevent exposure.

Several hours later, attack code did appear, and php sites all over the internet have been attacked, and continue to be attacked at this moment.

We brought the site up after fully patching php, and while it cost us both in SEO and revenue it was well worth it.

There is a continued risk, across the internet the majority of sites will take ages to be patched, some might never be. Any information you provide to those sites is likely to be compromised, including passwords.

If you own a website either personally or for your business, PLEASE, get your tech person onto it and have it patched if it is PHP based.
 
Larry S
Posts
13,997
Likes
54,298
You guys rock! Thanks for keeping this site and Us safe.
 
Trev
Posts
2,423
Likes
3,254
Completely unprecedented and the fallout from this will be massive in the days and weeks to come.

So many PHP sites (almost all watch forums!), stayed online while they were vulnerable to these exploits. It was basically a point-and-click attack too, with low skill threshold. Own any website you want.

So, be very careful with your data and personal info. Keep a close eye on your accounts from other watch forums and sites in general.
 
Tony C.
Posts
8,280
Likes
29,274
Thank you for your diligence. Is there an easy way to identify PHP sites?
 
Trev
Posts
2,423
Likes
3,254
Tony C. Tony C.
Thank you for your diligence. Is there an easy way to identify PHP sites?
Not usually, but almost every watch forum (and forums in general) are PHP backed. It's rare not to be. It's 70.5% of the internet.

There was a bunch of government sites in the EU that took themselves offline for protection, but so many that didn't. Lots of crusty old forums that I'd be very cautious about now.
 
bsowers34
Posts
2,464
Likes
11,877
dsio dsio
We became aware of two CVE’s (Common Vulnerabilities and Exposures) of extremely serious severity impacting PHP, a software that 70% of the internet relies on, us included. https://www.php.net/archive/2026.php#2026-10-21-5

The announcement mentioned a patch due in just over a day, along with a full explanation of the exploit.

Due to the high rate of development of LLMs, and their ability to find attack vectors (especially once they know where to look), we did not believe the patch would arrive in time to protect the site.

We made the decision to bring the site down until the patch was available as a precaution to completely prevent exposure.

Several hours later, attack code did appear, and php sites all over the internet have been attacked, and continue to be attacked at this moment.

We brought the site up after fully patching php, and while it cost us both in SEO and revenue it was well worth it.

There is a continued risk, across the internet the majority of sites will take ages to be patched, some might never be. Any information you provide to those sites is likely to be compromised, including passwords.

If you own a website either personally or for your business, PLEASE, get your tech person onto it and have it patched if it is PHP based.
Omega website was down today too at least in the US.
 
Tony C.
Posts
8,280
Likes
29,274
Trev Trev
Not usually, but almost every watch forum (and forums in general) are PHP backed. It's rare not to be. It's 70.5% of the internet.
So presumably the safe, albeit irritating approach, would be to change all passwords, etc.
 
Trev
Posts
2,423
Likes
3,254
Tony C. Tony C.
So presumably the safe, albeit irritating approach, would be to change all passwords, etc.
Yes, especially if the same passwords are re-used across sites.
 
amuscare87
Posts
324
Likes
508
Thank you guys, I had a feeling this was the reason after reading a few articles about this yesterday. How this isn’t bigger news is beyond me but maybe I’m just too close to the space
 
dsio
Posts
35,752
Likes
40,033
bsowers34 bsowers34
Omega website was down today too at least in the US.
So we look at their site often, and of all the watchmakers they probably have the most effective and forward thinking tech team by a significant margin, wouldn't surprise me if they took precautions too.

amuscare87 amuscare87
Thank you guys, I had a feeling this was the reason after reading a few articles about this yesterday. How this isn’t bigger news is beyond me but maybe I’m just too close to the space

It's going to become really big news in coming months as people's private data gets sold at a rate never before seen, what is also extremely concerning is that there are attackers specifically targeting PHP shop front software like Magento which is extremely common.

What they can do with a watch dealer for example, is advertise a bunch of hot ticket pieces, Snoopys, Daytonas at well below market price, send out an email to customers advertising them, and intercept the checkout process, having you pay into the attackers bank account or credit card gateway.

The owner of the store wouldn't know until they've sold a dozen Snoopys and 30 Daytonas, at which point the customer has already lost their money and blames the store they legitimately bought it from. That's simply from using this PHP exploit to make config changes to an existing Magento store, and they can even do a mail out to the store's existing customer base to let them know about the fake listings.

Trev Trev
Yes, especially if the same passwords are re-used across sites.

Indeed, everyone should use a trustworthy password manager, use passkeys where possible and TFA where passkey is unavailable, also strong unique passwords for each website.
 
Trev
Posts
2,423
Likes
3,254
amuscare87 amuscare87
Thank you guys, I had a feeling this was the reason after reading a few articles about this yesterday. How this isn’t bigger news is beyond me but maybe I’m just too close to the space
It'll end up being bigger news for sure.

It felt very strange taking the whole site offline that early on, but proved to be the right choice. I'm so glad we did. We knew right away that people would throw clankers at PHP until they uncovered the vulnerabilities, and of course that's exactly what they did. The speed of humans having to dig through huge piles of code is no longer a consideration.
 
Jakeys
Posts
770
Likes
1,793
Once I saw how long the outage was, I clocked what you guys were doing. Smart move, well done.

It's impressive how proactive you guys are about maintaining this site.
 
Walrus
Posts
11,070
Likes
55,470
Maybe I’m missing something but I don’t understand how hackers love to disrupt internet traffic in general. Some people are bummers.
 
Trev
Posts
2,423
Likes
3,254
Walrus Walrus
Maybe I’m missing something but I don’t understand how hackers love to disrupt internet traffic in general. Some people are bummers.
The short version is that it's about making money: via credential theft and fraud, crypto mining, etc.
 
noelekal
Posts
7,154
Likes
57,747
Read this with interest.

We are grateful that our moderator team diligently supports the Forum for the benefit of all.

Thanks guys!
 
Felix_La_PuBelle
Posts
1,128
Likes
6,521
If only other online “social” websites were run with this kind of regard for their community, I might be more active on those other sites. Cheers OF.
 
Speed2Sea
Posts
965
Likes
5,278
Felix_La_PuBelle Felix_La_PuBelle
If only other online “social” websites were run with this kind of regard for their community, I might be more active on those other sites. Cheers OF.
Agreed. And, it would be nice if members would become Tier 1 or 2 supporters.
Edited:
 
Ron_W
Posts
1,986
Likes
3,877
Thanks for beiing so proactive and diligent, keeping us safe !
 
7 More Posts...
Sign up or log in to reply...

Similar threads

M

Wore a Submariner for a Day

Mac-427 Modern Omega Watches
sah
sah
Posts
15
Views
14K