Has phpBB been patched for the global php vulnerability?

[Justabackup]

Asking for a friend

[Woodstock]

Having spent time dealing with this "global catastrophic event!!!!" of a PHP vulnerability, I found that, the closer you are to absolute latest version, the closer you are to a problem. If, that is, you install the system in stupid ways.

There are a number of ways to defeat the attacks, if you aren't trying to use every PHP feature. And a friend is dealing with the fact that his brand-new install, verified yesterday, is already 6-months behind, because the "fix" hasn't been certified by his distribution as being SAFE yet. It could be several months before it can be certified, based on the fixes that haven't been cleared yet.

But, it makes for "good press".

(oh, and phpBB isn't vulnerable to the attack any more that any other PHP program. if the system is built in a way that supports the vulnerability, then it doesn't matter what program you're running.)