One of the admin accounts appears to have been compromised. The owner/other admins appear to be aware now because that account had its admin access revoked and offending posts are being removed.
Definitely opens up a big question about the security of Lemmy instances that I am sure will be discussed over the next few days.
More time will definitely be needed. I'm glad they caught it and acted quickly enough to prevent more vandalism from occurring, but until we know how the account was compromised and what else they may have gotten in the process, it's still a situation to keep an eye on.
I like KeePass. Bitwarden currently has an nginx exposure in the Dockerfile published in their git repo (may have been fixed since a couple of days ago). That said, I used Bitwarden for many years and switched out of an abundance of paranoia, and am definitively not recommending against it. Just basically use one of the following:
This was not the first and it won't be the last. They've had issues going as far back as 2015. Don't keep your credentials with a paid platform. Use something you can fully audit and control yourself like Bitwarden or KeePass
I don't know that 1password should be on that list. The first two are free and open source. The last one is paid and proprietary.
Don't put your credentials in the hand of a company that requires you to trust them to not fuck up. Everyone thought LastPass was great until they weren't
Not a whole lot - you might see some spam being federated from lemmy.world but I'd expect the lemmy.ml and lemmy.world admins will fix it, and them clean it up.
That's probably good stress test to figure out how to handle that.