As someone in EU I didn't even realized there was an issue. Well done and great reaction time! Also thank you for the transparency 👑

Pardon the ignorance, but how do I know if I was compromised? what do?

Must have been jealous spez

Thanks for the transparency. Was having issues with Lemmy, now seems everything back to normal. Got a question, Just to add an extra layer of security, Do i need to use ToR or VPN with Lemmy ?

Rock on, Rudd.

If I'm not from lemmy.world and visited a lemmy.world community via my home instance, does the hacker gain access to my account?

If I, while logged in to my home instance, accessed lemmy.world in another tab, does the hacker gain access to my account?

Does this hack infect devices used to access lemmy.world?

Sorry for noob questions, I'm just worried.

With the JWT secret rotation, shouldn't everyone be forced to re-login? I'm posting with my existing session without any changes.

Well that's just great it really is a shame though how some people would actively want to ruin something free like this just because they can.

Excellent, thanks for the quick response ruud and admins.

It seems there is no way in Lemmy to invalidate all your session cookies? Without that, how can you secure an account which has a stolen session cookie?

Thank you for taking the time to update this :) Hope everything will be sorted out without people being scared. As a layman, was any user data compromised?

Thanks all working again. Had to clear my browser cache in order to login again and had to resign in to memmy too.

I guess its early days for lemmy for incidents like this, fingers crossed something like this doesn't happen again :)

Here's a relevant post that talked about this with @AlmightySnoo@lemmy.world I think is worth looking into for anyone curious what exactly happened.

https://sh.itjust.works/post/923025

please don't visit the legal section of the website or anything confirmed compromised if anything.