Forum Security Updates

[Picuino]

The forum's actual software version is 2.0.19 (from 2021), while the latest released version is 2.1.7 (from March 2026).
I believe this could leave dangerous security holes, especially now that Claude Mythos (and soon other models) will be able to automatically find and exploit significant security vulnerabilities (zero-day exploits) in several systems.

https://www.simplemachines.org/community/index.php?topic=593921.0

[gnif]

While the forum reports a certain version, it doesn't mean we are not maintaining it and patching known vulns in it. We do not "upgrade" as per the usual path as this build of SMF has been altered for our cluster deployment and upgrading is not really an option anymore with our diverged code base.

Furthermore, 2.0 -> 2.1 is a massive upgrade and will break many of the plugins we use that our forum members make heavy use of, it's not a simple upgrade path for anyone, let alone one of the largest SMF forums on the planet.

[Picuino]

Yes, it’s really hard to maintain a forum of this size—and keep it going for many years. The other SMF electronics forum in Spanish has been in a real slump for quite some time now, probably because users have migrated en masse to mainstream social media.
We’re very lucky to have this forum and for it to remain so active.

[golden_labels]

With time a divergent codebase becomes a baggage. Speaking from own experience, though the forum was somewhat smaller.⁽¹⁾

The further the incompatibility goes, the harder it becomes to merge updates, the more one becomes a one-man-orchestra trying to do the job meant for an entire development team.

In our case it was phpBB2 with many ad-hoc changes and customized mods. We were stuck with it even after mold started to grow on phpBB3.

⁽¹⁾ A non-English forum with 190k posts after 10 years of operation. 15k accounts, with a policy of not requiring an account to write.

[Haenk]

With time a divergent codebase becomes a baggage. Speaking from own experience, though the forum was somewhat smaller.⁽¹⁾

I'd say that is the case for every individually customized software. This always becomes a "let's do the upgrade next year" thing when used in production. As me how I know

[EEVblog]

While the forum reports a certain version, it doesn't mean we are not maintaining it and patching known vulns in it. We do not "upgrade" as per the usual path as this build of SMF has been altered for our cluster deployment and upgrading is not really an option anymore with our diverged code base.
Furthermore, 2.0 -> 2.1 is a massive upgrade and will break many of the plugins we use that our forum members make heavy use of, it's not a simple upgrade path for anyone, let alone one of the largest SMF forums on the planet.

Yes, I suspect it would be just as easy (hard) to move to another forum software like XenForo than to upgrade SMF.

[freakinworks]

Hopefully this forum incorporates the latest security release of PHP 8.5.12.

[Jeroen3]

While the forum reports a certain version, it doesn't mean we are not maintaining it and patching known vulns in it. We do not "upgrade" as per the usual path as this build of SMF has been altered for our cluster deployment and upgrading is not really an option anymore with our diverged code base.
Furthermore, 2.0 -> 2.1 is a massive upgrade and will break many of the plugins we use that our forum members make heavy use of, it's not a simple upgrade path for anyone, let alone one of the largest SMF forums on the planet.

Yes, I suspect it would be just as easy (hard) to move to another forum software like XenForo than to upgrade SMF.

Perhaps moving is easier then ever before if you can create migration plugins with ai agents.

[Kleinstein]

Hopefully this forum incorporates the latest security release of PHP 8.5.12.

That fix should be independent from the forum software. It would be very few if any packages where the PHP fix would break things (maybe a few that are far behind with PHP for some older changes).

[ledtester]

Hopefully this forum incorporates the latest security release of PHP 8.5.12.

Even without the update Cloudflare should be protecting us from the php2shell exploit.

https://blog.cloudflare.com/php-vulnerabilities-waf-protection

[EEVblog]

Hopefully this forum incorporates the latest security release of PHP 8.5.12.

Yes it has.