<p>There was a <a href="https://github.com/craftcms/cms/blob/main/CHANGELOG.md#4415---2023-07-03-critical" rel="nofollow noreferrer">bug in Craft 4 mentioning RCE vulnerabilities</a>, and I saw the same results of hacking on my site(s), but I'm not sure about such an old version of Craft.</p>
<p>Can you restore the site from a previous database backup? You will need to find a backup that predates the hack.
After that, I would suggest:</p>
<ul>
<li>Upgrade to the latest point release for Craft 2, better yet, make a plan to upgrade all the way to Craft version 4.</li>
<li>Reset all user passwords, and review all permissions and delete all unneeded accounts</li>
</ul>
<p>Maybe others can chime in here with additional security suggestions.</p>

CC BY-SA 4.0
2023-12-06T01:17:04.253Z
Agreed. Craft 2 hasn’t been updated in over 3 years and Craft 2.3 is over 8 years old.
Ben Croker
CC BY-SA 4.0
2023-12-05T22:57:22.753Z
2023-12-05T22:57:22.753Z
4midori
<p>My site was hacked by a Russian hacker. I know because the characters were Russian on one of the files he left. I have cleaned up the site, but many of the links are looping back to the home page. What can I do to fix this? Thanks</p>
<p>I have Craft 2.3, php 7.1, mysql, and here is the site: camp.gsnorcal.org</p>
<p>Appreciate your feedback</p>

CC BY-SA 4.0
2023-12-06T01:20:20.353Z
You seem to know a lot about this hacker based on just a few characters left behind...? It’s most likely an automated script that managed to penetrate the site. Follow @4midori’s advice and upgrade to a supported version of Craft.
Ben Croker
<craft2>
My site has been hacked. I have managed to clean it up. But now, most of my links are looping back to the home page
# My site has been hacked. I have managed to clean it up. But now, most of my links are looping back to the home page

(Asked by: username_0 on 2023-12-05)

My site was hacked by a Russian hacker. I know because the characters were Russian on one of the files he left. I have cleaned up the site, but many of the links are looping back to the home page. What can I do to fix this? Thanks

I have Craft 2.3, php 7.1, mysql, and here is the site: camp.gsnorcal.org

Appreciate your feedback

**Tags:** craft2

> **Comments:**
> **username_1**: You seem to know a lot about this hacker based on just a few characters left behind...? It’s most likely an automated script that managed to penetrate the site. Follow @username_2’s advice and upgrade to a supported version of Craft.  

---

## 1 answers

### Answer by username_2 on 2023-12-05. Score: 3

There was a [bug in Craft 4 mentioning RCE vulnerabilities](https://github.com/craftcms/cms/blob/main/CHANGELOG.md#4415---2023-07-03-critical), and I saw the same results of hacking on my site(s), but I'm not sure about such an old version of Craft.

Can you restore the site from a previous database backup? You will need to find a backup that predates the hack.
After that, I would suggest:

* Upgrade to the latest point release for Craft 2, better yet, make a plan to upgrade all the way to Craft version 4.
* Reset all user passwords, and review all permissions and delete all unneeded accounts

Maybe others can chime in here with additional security suggestions.

> **Comments:**
> **username_1**: Agreed. Craft 2 hasn’t been updated in over 3 years and Craft 2.3 is over 8 years old.  

---

