Lots of MODx Evolution 1.0.15 Sites are hacked AFTER security patch was applied

Hello there!

Lots of our MODx Evolution sites (~30 out of 50) have been hacked tonight AFTER we have applied this security patch:

https://forums.modx.com/thread/101240/evo-security-patch-1-0-12-and-above

We've patched on 16th November, all sites looked OK, then. Today, many hosters have send us mails, that malicious code was detected. And indeed, we must confirm that.

Any ideas?

Please post this issue in Github, not here

Also, please provide as much infomation as you can ref. files, server, port of entrance etc.

To also note is:

Did you check the database for hacked code ? You have to, as the hack inserts code into the database

If you have cleared the server of malicious code but not modified / checked the database, you will continue to be hacked

Read at least here and here

It's possible that the hack occurred earlier. It's very common for hacker bots to install an entry point without doing anything else (other than notifying the bot's user). Exploiting the entry point can come much later.

As noted now on GitHub, the patch was updated on 17th November, so possible you do not have the latest patch applied.