have i been hacked?

Apparently your host has register_globals enabled by default. If so, run away FAST.

its a clients sites... i dis mention this.. well i guess they know the true cost now.

Cheap hosting isn’t always inexpensive. Inexpensive hosting doesn’t always have to suck, either, but it frequently bites you in the backside at very inopportune times.

Is there ever an opportune time to be bitten in the backside?

For me no. But I’m sure you can find a few spots on the Internet where it’s featured.

Ha! Ew...

so is this a known problem with modx.. are they any fixes.. or does my host just suck balls?

register_globals is a known problem with PHP, not MODx. It’s not hard to fix but who knows if your hosting company will be willing to do so. I’d suggest going with iPowerWeb. I had nothing but positive experiences with them back before I started hosting all my sites on my own server.

If you need an inexpensive host with super-simple 1-click installs, and you want to help indirectly support MODx, just sign up with Bluehost via our affiliate link. We’ve tested their service for months and can honestly give it a thumbs up. Good support, good hardware, good network, great price. It doesn’t sound like your needs are something that would require a dedicated or VPS solution.

Your host is at fault since it is not running in the standard secure environment. The reflect package is the cause of the issue but if the server had the recommended configuration by modx the problem would not be an issue. Modx has an alert message that warns users if register_globals is on, however in several cases developers will deactivate the error message rather than fix the server, and this is not modx’s fault. The developer who installs modx and bypasses the error message is ultimately at fault. Every open source (and many commercial) apps fall prey to this sort of problem but it is more often the users fault (by means of the host) rather than the actual apps fault.

My recommendation for everyone who is responsible for a web based application is to subscribe to whatever means of security notices that are available (modx has e-mail and feed subscriptions for security notices as well as a dedicated section in the forum and in recent releases notices within the manager itself).

From the download page:

Information on Security Notices and Important MODx News will be automatically delivered to your manager via RSS feed. If you install MODx on a public web server, please also subscribe to our Security Notices, preferably via both of the following as an extra measure of success: