It was later found that a security flaw in the custom CMS mybb.com uses to power its website allowed a malicious user to alter the download files to include their own code.