Huge MyBB security update

MyBB 1.8.15 has been released and it does contain a huge number of security fixes. 10 low and medium security vulnerabilities have been addressed with the .15 release.

24 other issues have been resolved, including important permission issues with the delayed moderation feature.

You should update your forum to 1.8.15 as soon as possible. If you can not update soon, check your moderators permissions and remove the delayed moderation permission to be safe.

Note that the update script is required for the 1.8.15 update.

MyBB 1.8.9 fixes one low security risk

MyBB 1.8.9 is out and it does fix one low security risk.

It is possible to start a CSRF attack on MyBB 1.8.8 when removing subscriptions. 1.8.9 does fix that issue.

There have been 52 other reported issues fixed so updating your MyBB is highly recommended although it’s not that urgent.

The fixed issues include:

Continue reading MyBB 1.8.9 fixes one low security risk

MyBB 1.8.8 fixes 7 security vulnerabilities

MyBB 1.8.8 has been released. The new version does fix 7 security vulnerabilities, four of them with a medium risk potential. There have been 58 issues fixed.

You should update your MyBB as soon as possible. Don’t forget to create a backup before updating your installation. The update script is required.

The Merge System has also been updated to version 1.8.8.

Scam warning for MyBB plugin developers

There is a new scam method being used since January 2016. New users with fresh accounts and very little posts are showing up in the official MyBB community forums or contacting MyBB plugin authors directly.

They are looking for custom plugins and promise to pay money above average prices for the plugins. They do accept the usual process in this case: The plugin is developed and the plugin author does provide a testforum based on MyBB to test the plugins abilities by the customer. After that, the coder is being paid and the plugin is delivered.

The new scam method has been reported by two plugin authors already and looks like this:

Continue reading Scam warning for MyBB plugin developers