The bad news is: We're running on an older version of PHP, one that won't be patched, and I can't upgrade to a newer one because SMF 2.0 doesn't support them. To do that, we'd also need to upgrade to SMF 2.1, which is a MAJOR job - and, I know from other forums that have made the switch, there are enough differences between 2.0 and 2.1 to cause significant friction with users (i.e. you lot
).The good(ish) news is: Because I recently moved us to a new server & a new containerised system (docker, for those who know what that is - if you don't, it's not vital to the news), so we're already partly protected. I've also just made some configuration changes that SHOULD make us pretty much secure. It's not 100% guaranteed... but fingers crossed: And even if they do get into the system, they're stuck in a container they can't get out of, which will significantly reduce any damage they could do.
With regards to the database - the DB is backed up nightly, with one backup retained for a week - so if anyone does notice anything funky, as long as it's reported quickly, we'll lose at most 1 day's worth of posts.
Unfortunately I'm severely time constrained right now, which means I don't know how much of a chance I'll get to do a trial migration to v2.1 + upgrade to latest PHP + patches; but I'll try to fit it in if I can. Then I'll need some volunteers to take a look at it/test it to make sure the new user interface isn't going to cause problems. I'll post any news up here & in the chatterbox board.