Seems like everything is good now, and it looks like those funky URLs are gone. I haven’t tried Tapatalk yet.
ETA: I just tried Tapatalk and it showed no threads either subscribed or participated. I logged out and back in and now it looks like everything’s back to normal.
Okay, now that we’re back to normal, I’ll say what I didn’t say before: cookies were not being set. They replaced the session cookie with that weird URL, but apparently didn’t keep accessing all the other cookies. My suggestion was going to be that they could keep using the weird URL, but use the other cookies.
But then I was concerned that maybe using cookies was how the attacker got into the system–that maybe there was an exploit they used. So I kept my mouth shut. Now that cookies are back, I know that wasn’t the case.
Still think adding that one line for mobile would be a good idea, though. Give people an alternative. And it’s just a shame that the site that is so close to being mobile friendly.