Tauri confirms a data breach and asks every player to change passwords

Tauri, the Hungarian network behind the international Legion realm Evermoon, e-mailed its players on 28 October 2026 about a data breach. Early on 20 October, unknown attackers downloaded a large amount of data from one of its servers, and Tauri says it almost certainly included players' personal data. Players on r/wowservers say a notice about the attack had been on Tauri's website since 20 October.

What happened

Tauri says it saw unusual traffic on its database servers on the evening of 19 October. It looked like injection attempts but only caused a denial of service, and the team closed that route. Early the next morning activity spiked again, and someone downloaded the data through an administrative web service. Tauri thinks the attackers most likely used CVE-2026-109618 or CVE-2026-109619, two flaws that let attackers run code on PHP web servers. The PHP project released emergency fixes for both on 21 October.

What was taken

Usernames, e-mail addresses and IP addresses
Password hashes
Phone numbers, security tokens and invoices that players had saved
Tauri's own user identifiers

Tauri says it doesn't store bank card details, so none were in the stolen data.

What Tauri did

The team took its non-essential web services offline, turned off features that could be attacked and moved its public websites to servers running the fixed PHP version. It plans to separate the website further from its databases in the coming weeks, and it has reported the attack to the local authorities.

What players should do

Tauri asks everyone to change their password on its website and on any other site where they used a similar one. Players who already use two-factor authentication should delete it and set it up again, along with any security questions, and players who don't use it yet should turn it on. Because the PHP flaws gave attackers wide control over a machine, Tauri also suggests securing e-mail and password manager accounts first. Questions go to info@tauri.hu.

Sources: Tauri's e-mail to its players (28 October 2026), which a player posted in full on r/wowservers (29 October 2026), and Help Net Security on the PHP fixes (21 October 2026).