[Industry News]

MyBB 1.2.9 is a security update to the MyBB 1.2 series. It fixes a HIGH risk vulnerability just internally discovered in MyBB. We recommend everybody upgrades to this release as soon as possible or patches their boards with the manual patching instructions below.

We recommend all users upgrade their copy of MyBB to the latest available release. There is no proof of concept for this vulnerability available but there have been several attempts to use it against our official community forums.

This vulnerability allows a malicious user to perform arbitrary code execution within MyBB.

Immediately we're releasing a new version of MyBB which patches this exploit (MyBB 1.2.9). MyBB 1.1.8 is also affected.

MyBB 1.2.8 to MyBB 1.2.9 Patch
This patch is only for users running MyBB 1.2.8. If you are running any other version of the MyBB 1.2 series then please download MyBB 1.2.9 from the MyBB site and update to it.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.

mybb_129_changed_files.zip (Size: 14.15 KB / Downloads: 53)

If you wish to manually patch your board please download "mybb_128_code_fix.txt" and follow the instructions in that file.

mybb_128_code_fix.txt (Size: 1.81 KB / Downloads: 23)

MyBB 1.2/1.1 Plugin Patch
If you are running any 1.2 or 1.1 release of MyBB, you may alternatively use the attached plugin to protect your board from this vulnerability.

Upload it to inc/plugins/ and activate from your Admin CP --> Plugin Manager.

More...