Forum Activity for @claygordon

Hosting Service Provider Note: Update PHP to fix vulnerabilities

Installation and Configuration

Brian:

From my developer. who will be doing the update.

“Now we have to check what version is running on the server, if below the lowest 8.2 patched version then we have to upgrade the php first, and also we need to be sure if the current version of forum software is compatible with the upgrade php or not.”

We are running: PHP 8.1.30 on system core 7.0.3.

I assume we want to upgrade to the latest patched release version (PHP 8.5.12) and that that supports jR core 7.0.3.

Just confirming before we proceed.

Hosting Service Provider Note: Update PHP to fix vulnerabilities

Installation and Configuration

See attached screenshot from System Check:

Hosting Service Provider Note: Update PHP to fix vulnerabilities

Installation and Configuration

Brian –

I am self-hosting.

Hosting Service Provider Note: Update PHP to fix vulnerabilities

Installation and Configuration

Questions:

What is the preferred version of PHP to install and what version of the Core should I be running (a System check says all modules and skins are up to date).

NOTICE:

On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Active exploitation has been reported.

As we have no access to your VPS, VDS or dedicated server, we cannot apply the update for you. We therefore ask you to install it immediately as soon as patched packages are available for your system.

The vulnerabilities

CVE-2026-109618: remote code execution via out-of-memory corruption
CVE-2026-109619: remote code execution via stale global state

Both are rated 9.2 (critical) on the CVSS v4.0 scale. All PHP installations serving web requests are at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). Risk is highest for mod_php. Full details are in the official PHP security advisory.

Fixed PHP versions available

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35 (end of life on 31 December 2026, so please plan an upgrade)

Unrecognized error in timeline and profile

Using Jamroom

Michael:

It looks like the content (a comment on a community post) that generates this error was deleted.

Here’s the profile page with the error in full.
https://forums.thechocolatelife.com/alek-dabo

Unrecognized error in timeline and profile

Using Jamroom

This showed up this morning:

jrCore_db_get_item} required parameter "item_id" is missing () {jrCore_db_get_item} required parameter "item_id" is missing ()

I have not changed any code in any templates that might have generated this error that I can see so I am wondering what the source of the error is.
updated by @claygordon: 09/18/25 09:01:40AM

Forums no longer accessible – being logged out?

Using Jamroom

There is already an admin-level account. I will update the password and send it to you privately.

I have SFTP access to the folder in question. Does removing the module(s) in question remove it from the config?

I installed the module a long time ago (2017?) and Paul and I may have explored using it to update the look/feel. In 2017 I put the site into read-only mode and turned off new member signups. The only maintenance I did was to update the core and modules when I received email notices to do so.

I have no remembrance it was deprecated or to the instruction to remove it.

Forums no longer accessible – being logged out?

Using Jamroom

When I try to remove the Site Building module – one way is by clicking on the Info button in the attached image – an HTTP 500 error is generated. (The same happens when I select the module in the Site Builder section of the left nav. There is a D in a green square to the right of the module name.)

Is there any other way to remove the module? Without a reinstall?

Changing subdomains – jR & DNS configuration requirements

Installation and Configuration

I have a self-hosted site that is sitting at a subdomain (sub.domain.tld) and I want to change the subdomain – new_sub.domain.tld.

What changes do I need to make in the ACP and what changes need to be made to config files to ensure a smooth transition?

For those with experience, what DNS changes need to be made to ensure that SEO associated with the legacy domain is not lost?
updated by @claygordon: 07/16/25 07:42:36PM

Forums no longer accessible – being logged out?

Using Jamroom

This solved the problem - Thanks! I was wondering about this as it’s been a while since I’ve been looking at quota configs: it seems a little counterintuitive that quotas have profiles but it may be that I am more than a bit rusty here.

One thing I am noticing, however, is that the Integrity Check always hangs: - it stops here (in the attached image) and doesn’t terminate as expected.