Forums Hacked

[pmeenan]

Ping me offline and I can get them to you (pmeenan@webpagetest.org).

The PHP interpreter will apparently execute anything inside of a <?php ?> pair of tags, even if it is a binary file so the problem isn't unique to images. Jpegs have a fun feature that lets you include arbitrary data in header tags (like the exif data) so it is easy to build an image that looks normal but has executable code within it.

Stripping out all tags or recompressing (without maintaining tags) all user-uploaded images is probably the safest way to secure them (besides making sure php won't be called to execute an image file).