Tamsin

I've only just submitted this ticket, but I just wanted to drop in here and draw attention to it, since it is the hugest problem by far that I have EVER, EVER had, and it's already had some serious ramifications in just the time I've been asleep.

Looks like last night Apache was recompiled on my dedicated server by helpdesk, to fix a completely non-related issue issue. However, it has not be compiled with PHP support from the looks of things, and NONE of my PHP files are now being parsed server side at all - they are displaying in browser windows. This has already caused at least five of my database username/passwords to be compromised, and I am desperately trying to do damage control now by deleting any file that queries sql, but I have no idea if this information has circulated yet, no way to change the usernames/passwords (as obviously I can't access PMA either), and it would be a ten second task for someone who managed to download one of my scripts pulling sql information to upload it elsewhere, modify it and pull/change information from my dbs right now, so I am literally having something of a crisis.

ANYTHING that could be done to help this process be sped along right now would be hugely, hugely appreciated.

Tamsin

Bleh, ignore this. For some bizarre reason, AddType application/x-httpd-php .php had been commented out in PHP conf. Fixed the issue and restarted Apache and everything back to normal now.

Could still benefit from some help with damage control, but I've managed to resolve the huge issue.

Dan

Glad you figured out your problem, but next time if you're going to request help with a ticket through the forums, please leave us the ticket ID so we can at least look it up

__________________

H

This is why dispatch files are helpful. And even more so, why having config files outside of the document_root is important.

Sorry that it happened, but everytime I tell people to move connection files and even other important files out of the public_html root, they kinda laugh and say it'll never happen. But if it does... yep, password exposure = BAD.