今天早上打開郵箱收到了來自Drupal官網(wǎng)的聲明以及要求用戶修改密碼的郵件。大體內(nèi)容就是講述官方發(fā)行系統(tǒng)被外界通過在服務(wù)器上的第三方系統(tǒng)的漏洞而非法入侵，而不是社區(qū)網(wǎng)站本身自己的漏洞，用戶的用戶名，郵箱，以及hash過得密碼庫被泄露。

郵件全文如下:

Dear community member,

We respect the privacy of your information, which is why, as a precautionary measure, we are writing to let you know about an incident that involves your personal information. The Drupal.org Security and Infrastructure Teams have discovered unauthorized access to account information on Drupal.org and groups.drupal.org. Information exposed includes usernames, email addresses, and country information, as well as hashed passwords. However, we are still investigating the incident and may learn about other types of information compromised, in which case we will notify you accordingly.

This unauthorized access was made via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within the Drupal software itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally.

We have implemented additional security measures designed to prevent the recurrence of such an attack, and to protect the privacy of our community members.

The next time you attempt to log into your account, you will be required to create a new password.

Below are steps you can take to further protect your personal information online. We encourage you to take preventative measures now to help prevent and detect the misuse of your information.

First, we recommend as a precaution that you change or reset passwords on other sites where you may use similar passwords, even though all passwords on Drupal.org are stored salted and hashed. All Drupal.org passwords are both hashed and salted, although some older passwords on groups.drupal.org were not salted.

To make your password stronger:

* Do not use passwords that are simple words or phrases(不要使用弱密碼)

* Never use the same password on multiple sites or services(不要在不同網(wǎng)站使用相同密碼)

* Use different types of characters in your password (uppercase letters, lowercase letters, numbers, and symbols).(密碼中使用不同類型的字符組合)

Second, be cautious if you receive emails asking for your personal information and be on the lookout for unwanted spam. It is not our practice to request personal information by email. Also, beware of emails that threaten to close your account if you do not take the “immediate action” of providing personal information.