This forum is being actively monitored by CVE-2019-9670 exploiters

[gabrieles]

It's clear that this forum is being monitored by exploiters and used to modify the attack vector accordingly.

One of the steps of the attack is to modify the date of the files
/opt/zimbra/mailboxd/webapps/zimbra/js/zimbra/csfe/XZimbra.jsp
/opt/zimbra/mailboxd/webapps/zimbra/public/Ajax.jsp
/opt/zimbra/mailboxd/webapps/service/error/attachment_blocked.jsp
/opt/zimbra/mailboxd/webapps/zimbraAdmin/public/jsp/Debug.jsp
to december 2014, to hide that a line of code has been added to these files.

This is a direct and clear response to the
find /opt/zimbra/jetty/ -type f -name *jsp -mtime -60

Must switch to a more secure way to share these information

[phoenix]

Perhaps a private group on Telegram might be more appropriate?

[gabrieles]

It's the farthest thing from the "community" and the "open" philosophy , but in this case could be of help...

[phoenix]

It's the farthest thing from the "community" and the "open" philosophy , but in this case could be of help...

I agree but I don't see any alternative if the forums are being 'monitored'. Perhaps you should only accept known users via their forum (long-standing accounts?) membership here?

[DualBoot]

Sometime diffusion/distribution lists are better at this purpose.

Regards,