Answers.Body: <p>There was a <a href="https://github.com/craftcms/cms/blob/main/CHANGELOG.md#4415---2023-07-03-critical" rel="nofollow noreferrer">bug in Craft 4 mentioning RCE vulnerabilities</a>, and I saw the same results of hacking on my site(s), but I'm not sure about such an old version of Craft.</p>
  <p>Can you restore the site from a previous database backup? You will need to find a backup that predates the hack.
  After that, I would suggest:</p>
  <ul>
  <li>Upgrade to the latest point release for Craft 2, better yet, make a plan to upgrade all the way to Craft version 4.</li>
  <li>Reset all user passwords, and review all permissions and delete all unneeded accounts</li>
  </ul>
  <p>Maybe others can chime in here with additional security suggestions.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-12-06T01:17:04.253Z
Answers.Text: Agreed. Craft 2 hasn’t been updated in over 3 years and Craft 2.3 is over 8 years old.
Answers.UserDisplayName: Ben Croker
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-12-05T22:57:22.753Z
Answers.LastActivityDate: 2023-12-05T22:57:22.753Z
Answers.UserDisplayName: 4midori
Body: <p>My site was hacked by a Russian hacker. I know because the characters were Russian on one of the files he left. I have cleaned up the site, but many of the links are looping back to the home page. What can I do to fix this? Thanks</p>
  <p>I have Craft 2.3, php 7.1, mysql, and here is the site: camp.gsnorcal.org</p>
  <p>Appreciate your feedback</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-12-06T01:20:20.353Z
Comments.Text: You seem to know a lot about this hacker based on just a few characters left behind...? It’s most likely an automated script that managed to penetrate the site. Follow @4midori’s advice and upgrade to a supported version of Craft.
Comments.UserDisplayName: Ben Croker
Tags: <craft2>
Title: My site has been hacked. I have managed to clean it up. But now, most of my links are looping back to the home page
ThreadText: # My site has been hacked. I have managed to clean it up. But now, most of my links are looping back to the home page
  
  (Asked by: username_0 on 2023-12-05)
  
  My site was hacked by a Russian hacker. I know because the characters were Russian on one of the files he left. I have cleaned up the site, but many of the links are looping back to the home page. What can I do to fix this? Thanks
  
  I have Craft 2.3, php 7.1, mysql, and here is the site: camp.gsnorcal.org
  
  Appreciate your feedback
  
  **Tags:** craft2
  
  > **Comments:**
  > **username_1**: You seem to know a lot about this hacker based on just a few characters left behind...? It’s most likely an automated script that managed to penetrate the site. Follow @username_2’s advice and upgrade to a supported version of Craft.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2023-12-05. Score: 3
  
  There was a [bug in Craft 4 mentioning RCE vulnerabilities](https://github.com/craftcms/cms/blob/main/CHANGELOG.md#4415---2023-07-03-critical), and I saw the same results of hacking on my site(s), but I'm not sure about such an old version of Craft.
  
  Can you restore the site from a previous database backup? You will need to find a backup that predates the hack.
  After that, I would suggest:
  
  * Upgrade to the latest point release for Craft 2, better yet, make a plan to upgrade all the way to Craft version 4.
  * Reset all user passwords, and review all permissions and delete all unneeded accounts
  
  Maybe others can chime in here with additional security suggestions.
  
  > **Comments:**
  > **username_1**: Agreed. Craft 2 hasn’t been updated in over 3 years and Craft 2.3 is over 8 years old.  
  
  ---
  
  