Could there be an email signup for when Ghost is hacked?

Using Ghost
1

I’m one of the 700 websites that was hacked. How could I have found out more proactively? Since the problem was found in february? The only real damage for me was mailgun shut my account off because it was generating spam. But I was a dummy and didn’t realize that ghost 1) needed to be manually updated and 2) that the updating process can have serious issues. I’ve just spend the last week fixing three extremely broken updates from Ghost 6 to Ghost 6 with lots of database issues. Everything including my themes are now up to date, api keys have been replaced, admin security has been reset, mailgun has been repaired.

2

I just found a way to subscribe to releases notifications on GitHub:

To receive notifications for every new version of the Ghost CMS on GitHub, you need to “watch” the releases for the repository.

Here is how you can set it up:

  1. Go to the main TryGhost/Ghost Repository on GitHub.
  2. Click the Watch button in the top-right corner.
  3. Select Custom from the dropdown menu.
  4. Check the box for Releases.
  5. Ensure your GitHub Notification settings are configured to alert you via your preferred method (web, mobile app, or email) in your account settings. [1, 2, 3]
1 Like
3

Just a note that Ghost does a release about once a week, mostly Thursday/Friday. Sometimes with another release mid-week, if something got out that wasn’t quite perfekt. Another reasonable option here might be that you update your server once a week. (That’s my pattern. Saturday morning tea and ‘ghost update’. Usually I finish the update before the tea.)

Ghost actually does send you an email if you have a critically vulnerable site, but this assumes that you have outgoing transactional email configured, and that you saw it. Ghost also has had a big half-screen tall alert on the admin panel, although it’s possible that your version of Ghost was so old that it didn’t. (I don’t know when that feature was added, exactly.)

I’ve generally found no problems with running Ghost update. I think the last time I saw a database issue was about Ghost 5.80-something. Are you running MySQL 8, or something else? Anyway, if you hit a snag updating, please post to the forum about it!

4

Thanks Cathy, I ran into tons of database issues from a pre-5.8 release on three sites. I resolved them by exporting JSON and members, spinning new images at Digital Ocean, emptying out the databases and letting Ghost recreate them copying all the images back importing the JSON file and re-importing the members on 3 websites. But now everything is up to date.

5

Oh and to re-institue mailgun I needed to change APIs and passwords and invalidate all admins and have them get new passwords. I was running MySQL8 but ran into A LOT of Foreign key issues and I googled like mad but none of the solutions worked except having the current version of Ghost re-create the databases…