An unknown attacker has compromised download links for the phpBB forum software, according to a statement released today by the phpBB development team.
The hacker compromised only two downloads links, for the phpBB 3.2.2 full package and the phpBB 3.2.1 -> 3.2.2 automatic updater. This is phpBB's latest version, released on January 7, this year.
The compromised download links were live only for 181 minutes, between 12:02 PM UTC and 15:03 PM UTC on yesterday, January 26.
The phpBB team did not reveal exact details of how the attacker managed to poison the download links, and only said:
phpBB staff removed the links to the malicious files as soon as they were discovered. They said the download links pointed off-site to malicious versions of the original phpBB files that also contained additional "malicious code."
"We are actively working with the third-party to investigate the attack vector utilized in the intrusion and will provide more information as it becomes available," Cullum added. "We can again confirm that neither our servers, nor the phpBB software, were exploited during these events."
"Due to our infrastructure team’s ability to respond swiftly, the malicious packages were only in place for 3 hours," Cullum told Bleeping Computer. "This period was likewise one of the quietest periods on our website for downloads. Based on our calculations, we estimate the total number of affected downloads does not exceed 500. We expect a far smaller number were utilized in a production environment."
Cullum said the phpBB team is still investigating and will publish more details once they know more.
"Our main priority at this time is to be as thorough as possible in our investigation to fully ensure the safety of our users," he said. "It is always our policy to inform the community at the earliest opportunity and then provide continuing information as we are able to ensure its accuracy."
Users who downloaded phpBB 3.2.2 packages on Friday are advised to verify the SHA256 file hash of the file they downloaded against the one listed on the phpBB official downloads page.
"The downloads currently available on the downloads page are safe," the phpBB team said.
phpBB is a very popular PHP-based discussion board, currently in use on 0.2% of all sites on the Internet, according to W3Techs.
This is not the first time when the official website of a popular software is hacked to distribute malware. Hackers previously breached the website of the Elmedia Player to distribute the Proton RAT, the website of the HandBrake transcoder app to distribute the same Proton RAT, and the website of the Transmission BitTorrent client twice to distribute the KeRanger ransomware, and later the Keydnap infostealer malware.
UPDATE [January 28, 05:40 ET]: Article updated with comments receveid via email from Cullum.