AVideo Platform Security Releases

AVideo Platform Security

This page contains security best practices, known vulnerabilities, and security releases for the AVideo Platform. Keeping your installation secure is critical - please review this document regularly.

⚠️ Important: Always update your AVideo installation when security patches are released. Monitor the GitHub releases page for security announcements.

---

Table of Contents

1. Security Best Practices
2. How to Report Security Issues
3. Checking for Vulnerabilities
4. Security Releases History

---

Security Best Practices

Follow these guidelines to keep your AVideo installation secure:

1. Always Keep AVideo Updated

• Regularly check for updates: Admin → Update Version
• Monitor GitHub Releases for security patches
• Update immediately when security releases are announced
• See: How to Update your AVideo Platform

2. Use HTTPS (SSL/TLS)

• Always use HTTPS - never run a production site on HTTP
• Get a free SSL certificate from Let's Encrypt
• Redirect all HTTP traffic to HTTPS
• See: Why use HTTPS

3. Set Proper File Permissions

# Set ownership to web server user
sudo chown -R www-data:www-data /var/www/html/AVideo/

# Set directory permissions (755)
sudo find /var/www/html/AVideo/ -type d -exec chmod 755 {} \;

# Set file permissions (644)
sudo find /var/www/html/AVideo/ -type f -exec chmod 644 {} \;

# Make videos directory writable
sudo chmod 775 /var/www/html/AVideo/videos/

4. Protect the Videos Directory

The videos/ directory should NOT contain executable PHP files (except configuration.php).

# Check for unauthorized PHP files
ls -la /var/www/html/AVideo/videos/*.php

Only configuration.php should exist. Delete any other PHP files immediately.

Optional: Use the SecureVideosDirectory Plugin to prevent direct access to video files.

5. Use Strong Passwords

• Admin password should be at least 12 characters
• Use a mix of letters, numbers, and symbols
• Never use default passwords
• Change passwords regularly
• Consider enabling 2FA/OTP Login

6. Database Security

• Use a unique MySQL user for AVideo (not root)
• Set a strong database password
• Limit database user permissions to only what's needed

7. Server Hardening

• Keep your server OS updated
• Use a firewall (UFW, iptables)
• Disable unnecessary services
• Use SSH keys instead of passwords
• Consider fail2ban for brute-force protection

---

How to Report Security Issues

If you discover a security vulnerability in AVideo:

For Critical Vulnerabilities (Private Disclosure)

Do NOT open a public GitHub issue for critical security vulnerabilities.

Instead, contact the team privately:

• Email: developer@youphptube.com or developer@avideo.com
• Include detailed steps to reproduce the issue
• Allow time for a fix before public disclosure

For General Security Issues

• Open an issue on GitHub Issues
• Label it as a security concern
• Provide as much detail as possible

---

Checking for Vulnerabilities

Run these commands periodically to audit your AVideo installation.

1. Check for Suspicious PHP Files in Videos Directory

# List all PHP files in videos directory
find /var/www/html/AVideo/videos/ -name "*.php" -type f

# Only configuration.php should appear
# Delete any other PHP files immediately!

2. Check for Cryptocurrency Miners

# Search for known miner files
find /var/www/html/AVideo/ -name "xmrig*" -o -name "minerd*" -o -name "cpuminer*"

# Check for suspicious processes
ps aux | grep -E "xmrig|minerd|cpuminer"

# Check high CPU usage processes
top -bn1 | head -20

3. Check File Integrity

# Check for recently modified PHP files (last 7 days)
find /var/www/html/AVideo/ -name "*.php" -mtime -7 -type f

# Compare with git to find modified files
cd /var/www/html/AVideo/
git status
git diff

4. Check for Unauthorized Users

# In MySQL, check for unknown admin users
mysql -u youphptube -p -e "SELECT id, user, email, isAdmin FROM avideo.users WHERE isAdmin = 1;"

5. Review Apache/Nginx Logs

# Check for suspicious requests
grep -E "\.php\?" /var/log/apache2/access.log | tail -100

# Check for failed login attempts
grep -i "failed\|error\|denied" /var/log/apache2/error.log | tail -50

6. Automated Security Scan

Consider running periodic security scans:

• OWASP ZAP - Free web application security scanner
• Nikto - Web server scanner

---

Security Releases History

Security releases are listed below by date. Update immediately if you're running an affected version.

---

Release 1: 2017-Oct-26 (Cryptocurrency Miner Injection)

Severity: Critical
Affected: Early AVideo/YouPHPTube installations
Issue: Attackers injected xmrig (Monero CPU miner) into servers

Someone from IP 188.69.197.2 on Thu Oct 26 04:34:17 was hacking AVideo Platform servers for some days. They were injecting xmrig (Monero CPU miner) in the servers, causing services to be slow.

How to Know if You Were Infected

Run this command:

updatedb && locate xmrig

If you find these files, you were infected:

/var/www/html/YouPHPTube/videos/xmrig
/var/www/html/YouPHPTube/videos/xmrig.log

How to Remove

1. Delete the malicious files:

   rm /var/www/html/YouPHPTube/videos/xmrig*
   rm /var/www/html/YouPHPTube/videos/config.json
   rm /var/www/html/YouPHPTube/videos/upl.php

2. Search for other PHP files in videos directory:

   cd /var/www/html/YouPHPTube/videos/ && ls -lah *.php

   Only configuration.php is allowed here. Delete any other PHP file.

3. Update your AVideo Platform:

   • See: How to Update your AVideo Platform

4. Restart your server

You're clean now!

Video instructions: https://tutorials.avideo.com/video/security-releases-release-1-2017-oct-261

---

Stay Informed

• 🔔 Watch the AVideo GitHub repository for notifications
• 📢 Follow @avideoplatform on Twitter
• 💬 Join the Discord community

---

This document is updated when new security issues are discovered. Last reviewed: 2026