Just in case anything can be done...
https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o
PaulR
21 Oct 2026, 16:08PHP and MEM
Started by PaulR · 7 replies · 517 views
Jo
Reply #1 · 21 Oct 2026, 17:16I suspect we are not top of their list of sites to attack but we already get attacked multiple times every day.
Clearly they do not understand that all model engineers claim to be pennyless
so little point in trying to blackmail us. Worst case is they will take down the site and we might have to revert to a backup which would mean we would loose a few days of posts 
Jo
Clearly they do not understand that all model engineers claim to be pennyless
so little point in trying to blackmail us. Worst case is they will take down the site and we might have to revert to a backup which would mean we would loose a few days of posts Jo
PaulR
Reply #2 · 21 Oct 2026, 18:29This might be worth a read...
https://www.simplemachines.org/community/index.php?topic=595217.0
Seems like a patch will be out soon. Given the nature of php I wouldn't be surprised if more vulnerabilities are found by AI
https://www.simplemachines.org/community/index.php?topic=595217.0
Seems like a patch will be out soon. Given the nature of php I wouldn't be surprised if more vulnerabilities are found by AI
Laurentic
Reply #3 · 21 Oct 2026, 21:25
Mike!internal_fire
Reply #4 · 21 Oct 2026, 23:37I do not know anything about the inside of the MEM website, but the PHP problem is only for quite old versions of PHP.
If a relatively new version is in use (say, less than 2 years old) there is no problem.
I manage a completely unrelated website so I looked into this in some detail.
Upgrading the PHP version, if necessary, should be quite straightforward.
Gene
If a relatively new version is in use (say, less than 2 years old) there is no problem.
I manage a completely unrelated website so I looked into this in some detail.
Upgrading the PHP version, if necessary, should be quite straightforward.
Gene
admin
Reply #5 · 22 Oct 2026, 09:23So...
The bad news is: We're running on an older version of PHP, one that won't be patched, and I can't upgrade to a newer one because SMF 2.0 doesn't support them. To do that, we'd also need to upgrade to SMF 2.1, which is a MAJOR job - and, I know from other forums that have made the switch, there are enough differences between 2.0 and 2.1 to cause significant friction with users (i.e. you lot
).
The better news is: Because I recently moved us to a new server & a new containerised system (docker, for those who know what that is - if you don't, it's not vital to the news), so we're already partly protected. I've also just made some configuration changes that SHOULD make us pretty much secure. It's not 100% guaranteed... but fingers crossed: And even if they do get into the system, they're stuck in a container they can't get out of, which will significantly reduce any damage they could do.
With regards to the database - the DB is backed up nightly, with one backup retained for a week - so if anyone does notice anything funky, as long as it's reported quickly, we'll lose at most 1 day's worth of posts.
Unfortunately I'm severely time constrained right now, which means I don't know how much of a chance I'll get to do a trial migration to v2.1 + upgrade to latest PHP + patches; but I'll try to fit it in if I can. Then I'll need some volunteers to take a look at it/test it to make sure the new user interface isn't going to cause problems. I'll post any news up here & in the announcements page.
The bad news is: We're running on an older version of PHP, one that won't be patched, and I can't upgrade to a newer one because SMF 2.0 doesn't support them. To do that, we'd also need to upgrade to SMF 2.1, which is a MAJOR job - and, I know from other forums that have made the switch, there are enough differences between 2.0 and 2.1 to cause significant friction with users (i.e. you lot
).The better news is: Because I recently moved us to a new server & a new containerised system (docker, for those who know what that is - if you don't, it's not vital to the news), so we're already partly protected. I've also just made some configuration changes that SHOULD make us pretty much secure. It's not 100% guaranteed... but fingers crossed: And even if they do get into the system, they're stuck in a container they can't get out of, which will significantly reduce any damage they could do.
With regards to the database - the DB is backed up nightly, with one backup retained for a week - so if anyone does notice anything funky, as long as it's reported quickly, we'll lose at most 1 day's worth of posts.
Unfortunately I'm severely time constrained right now, which means I don't know how much of a chance I'll get to do a trial migration to v2.1 + upgrade to latest PHP + patches; but I'll try to fit it in if I can. Then I'll need some volunteers to take a look at it/test it to make sure the new user interface isn't going to cause problems. I'll post any news up here & in the announcements page.
Charles Lamont
Reply #6 · 22 Oct 2026, 11:18"... significant friction with users ..."
A quick look suggests SMF 2.1 is a considerable improvement, so when it happens it would behove 'us lot' to refrain from whingeing while we acclimatize.
A quick look suggests SMF 2.1 is a considerable improvement, so when it happens it would behove 'us lot' to refrain from whingeing while we acclimatize.
admin
Reply #7 · 22 Oct 2026, 11:49Quote from: Charles Lamont"... significant friction with users ..."
A quick look suggests SMF 2.1 is a considerable improvement, so when it happens it would behove 'us lot' to refrain from whingeing while we acclimatize.
hehe
I'm ambivalent tbh. As I wrote elsewhere, I'm not exactly keen on SMF's interface at all: It does, however, have the distinct advantage of being free to use without restriction, quite modifiable, and reasonably robust.
Although I think email might be broken right now
As soon as I've cleared my desk of urgent day job work, I'll need to take a closer lookQuick reply
Log in to reply.