[Ominous]

Pretty much immediately, he sent @Oni a message about it.

Well someone definitely wanted to brag about their "accomplishment."

So is this confirmed to be some sort of 0-day, or did the attacker smash their head into their keyboard and guess Oni's password?

Edit: Found some more info on this vulnerability/bug

Just a quick heads up that in the next 2-3 days a lot of rumors might spread about a 0day or MyBB exploit floating around.

It's nothing more than a very low security risk bug that requires credentials to be exposed as well as a malicious site visit (CSRF).

So don't be alarmed by news of this and start freaking out. You don't need to change your passwords or do anything different. Just exhibit the same common sense browsing habits you normally would to maintain your safety.

1. Don't download anything from potentially malicious sites.
2. Don't click links you're not familiar with. Important to hover over a link sometimes to ensure it's not forged anchor text.
3. Don't use the same password on HF anywhere else. This is seriously important.

Just don't worry about it though otherwise.