Bug in the forum since the move 1-2 months ago.
When you download an attachment from a private message, you get the correct file, but it's named index.php instead of the real name that the attachment has in the PM. The file should ideally have the right name when you download it.
Workaround: Download the attachment, then rename from index.php to what it really is.
Windows users might have to enable show-file-extensions. (Insert Simon rant that this is not default.)
I'll look at this tomorrow, but I have no clue how to fix yet.
-- Simon