Two critical security flaws in PHP, the language the forum software runs on, leaked before their planned disclosure date. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. They are reported to allow remote code execution: an attacker could run their own code on an affected web server. The PHP security team rates each one 9.2 out of 10 (CVSS v4.0).
The fix isn't public yet; it's scheduled for release on 21 October 2026. Until the patch is out and installed, we've taken the forum offline as a precaution. Your account and posts are not affected, and nothing has been lost.