We’ll update this as this is resolved.

UPDATE: Project web and Code Repository Services are back online.

Best Regards,
Chris Tsai, SourceForge.net Support

We’re performing some backend upgrades to help improve our site service, during this time, updates to the code repository viewers will be put on hold. This only impacts the repository viewer, and will not affect the repositories themselves, you will still be able to access them directly as normal (checkouts, clones, commits, etc.). We will update this post when this is completed.

UPDATE: the backend changes are complete and the code browsers are updating again.

Regards,
Chris Tsai, SourceForge.net Support

SourceForge staff will be on vacation for the upcoming US Memorial Day Holiday. We will monitor for any urgent issues and address them as appropriate during this time. Our regular hours for support coverage will resume on Tuesday, 2013-05-28.

Best Regards,
Chris Tsai, SourceForge.net Support

The mailing list archive view for SourceForge projects are currently in read-only mode for maintenance. Message sent to the mailing list continue to work, but until the maintenance is complete, the archives will not update. We expect this to complete sometime tomorrow.

Best Regards,
Chris Tsai, SourceForge.net Support

Apologies for the late notice. We are performing backend upgrades to the site shortly, and parts of the set will be set to read-only. We anticipate that this will take approximately 2 hours, and during this time, new user registrations, new login sessions will be not be possible. Additionally, various aspects of the classic SourceForge system will be read-only as well. Thank you for bearing with us as we complete this upgrade.

The front page, directory, projects, and download flow will remain online.

Best Regards,
Chris Tsai, SourceForge.net Support

We are expecting some previously unplanned downtime for the Project web and VHOST services to commence shortly. We are working to keep this downtime to as short a duration as possible.

Best Regards,
Chris Tsai, SourceForge.net Support

For example, in the Allura project source repository, you’ll notice a History link at the top right.

This will give you a history of just the ‘command’ directory.

Or, in a single file view, you’ll get the history of just that one file.

Since the CVS downtime yesterday, we’ve been experiencing poor performance for CVS. As such, we’ve disabled ViewVC and anonymous pserver access for the time being to prioritize developer read/write access while we address the performance issue. We do not have an estimate for the completion of this yet, but we will keep this post updated as this develops.

UPDATE: ViewVC is now available again, however, the data in ViewVC is still from before the previous downtime. Anonymous pserver is still offline. We’re working to get both these caught up with the latest updates as soon as we can.

UPDATE 2: As of 2012-12-06, anonymous pserver is back online. Note however that both anonymous access methods (ViewVC and pserver) will now lag behind developer changes. Under normal operation, they should be no more than one (1) hour behind. Developer access will always be current.

Best Regards,
Chris Tsai, SourceForge.net Support

We’re currently sorting through a scale-up of capacity for the project web and project DB services, and increasing scaling in our LDAP directory infrastructure. As this work, and testing of the platform with modern app revisions, is not complete, we are postponing the end of life of the Hosted Apps offering.

We will continue to update the Hosted Apps Retirement status page as we have more information, and ample notice will be provided when the new end of life date for the Hosted Apps service is announced.

The Project Databases for the Project Web will have some downtime for hardware maintenance tomorrow starting at 16:00 UTC on 2012-11-27.

This downtime will be a 12-hour rolling outage, with less than 60 minutes downtime for any given project.

The ability to update mysql passwords will be disabled during this entire window, and any password change attempts during that time will be processed after the downtime is complete.

Best Regards,
Chris Tsai, SourceForge.net Support

Databases for the project web service is currently offline, we’re troubleshooting this now, and are working to bring this service back up as soon as possible.

Best regards,
Chris Tsai, SourceForge.net Support

1. Project web (ie., projectname.sourceforge.net pages) and associated shell and database services. This also includes access through sftp, scp, and rsync via ssh. – Project web is back online.
2. Source Code Management repositories on Classic SourceForge platform. Repositories on the new SourceForge system are online. – code repositories are back online.
3. Hosted Apps. – Hosted Apps are back online.
4. Download Statistics updates, historical data is online, but updates aren’t running. No statistics are being lost. – Statistics updates are running again.

We will keep this post updated as we continue to diagnose and turn these services back on. We do not have an estimate for when this will be complete, but getting this resolved is our top priority right now.

Thank you for your patience as we work through this.

Best Regards,
Chris Tsai, SourceForge.net Support

We’ll be moving to an upgraded environment for Project web 21:00 UTC today. This will upgrade various packages, though php will be staying on 5.3, so many web-apps shouldn’t need updating. Python for cgi scripts will be upgraded to 2.6 as the default, with 2.7 available (2.4 will no longer be supported).

If you have any issues after this is complete, please let us know: http://sourceforge.net/support

Best Regards,
Chris Tsai, SourceForge.net Support

The mirror provider has confirmed the attack vector has been identified and is limited to their mirror; with exploit having occurred on or around September 22nd.

Through validation we have confirmed the corrupted file (a modified copy of phpMyAdmin-3.5.2.2-all-languages.zip) was served only via the ‘cdnetworks-kr-1′ mirror.

While we believe that only one file was modified on the ‘cdnetworks-kr-1′ mirror, we are conducting additional validation to confirm and will provide update once this process concludes. The mirror remains out of rotation.

Through logs, we have identified that approximately 400 users downloaded this corrupted file. Notice of this corrupted file has been transmitted through security notice by the phpMyAdmin project and direct email to those users we were able to identify through our logs.

This corrupted copy of phpMyAdmin included a backdoor which permitted execution of arbitrary commands by the web server user. The notice from phpMyAdmin may be seen at:
http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php

It is our recommendation that downloaders of this corrupted file (which contains ‘server_sync.php’) assess risk and take action as they deem appropriate, including deletion of the corrupted file and downloading a fresh copy.

Downloaders are at risk only if a corrupt copy of this software was obtained, installed on a server, and serving was enabled. Examination of web logs and other server data should help confirm whether this backdoor was accessed.

SourceForge thanks the phpMyAdmin team and the Tencent security team for escalating this issue.

Thank you,
The SourceForge team

We’re working on optimizing this so these items are processed more quickly. Thank you for your patience as we work through this.

UPDATE: the task queue has worked its way down to normal levels, and we’ve made some changes to the task processing so upgrades won’t cause as much delay with regular processing.

Best regards,

Chris Tsai, SourceForge.net Support