Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed

Teaser from the source

Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more.

This is the RSS-feed teaser. Read the full article at the original source.