We’re having a spam attack that’s making the forums non-functional! Woe!
I’ve enabled read-only mode for now, until someone more technically-minded can take a look, either in the morning or once she’s back from holidays (hi Jem!).
Apologies for the interruption in service!
Hi all! Normal service has resumed. We’ll be manually approving new sign ups for the time being, but this won’t affect existing users.
It was interesting to see how different browsers reacted to the read only setting. Firefox would only show that page and nothing else, while Vivaldi had this thread and page upon page upon page of luverly helpful spam, spam, spam, spam…
I’m on Firefox, too, so I didn’t see any spam at all, just that one page that told you to set up two-factor authentication. I did find the whole thing a wee bit weird and didn’t click on anything, thought I’d wait for a day or two whether something would change. Nice to see my bullshit sensors still working.
Chrome had me locked on the two factor authentication page…glad to see it got fixed!
Clicked in around the time of the attack, it was awful to see boring travel forum reality storming the world over here. So sorry you’ve had to deal with it and well recovered! 
Now I wonder whether the timing of this attack was coincidental… or whether we’ve seen a PHP2Shell preview.
Don’t worry, Discourse, the forum software, doesn’t use PHP. And it was not hacking exactly, just someone automating sign ups.