My hosting provider sent a security notice for every phpBB forum installed through its control-panel tools.
The provider planned to upgrade the forums between May 15 and May 17. The target was phpBB 2.0.20, which the notice described as the latest secure version. The reason was a new set of vulnerabilities in earlier releases.
The automatic upgrade came with a warning. Modified themes and scripts could be overwritten. A customer who wanted to prevent the provider from applying the patch could put an empty file named donotupgrade inside the forum directory.
Opting out moved the responsibility back to the customer. The notice said the customer would be responsible for keeping the forum secure. If an unpatched forum became the source of a server compromise, the hosting company could disable the site.
The message was tied to one hosted domain in my account. I am leaving the domain out of the public article because the source does not establish who owned the underlying project or whether it should still be associated with me.
I was running Praxis Technology and regularly dealt with small-business web and infrastructure systems. phpBB was common because it gave a project a working discussion forum without building one from scratch. The tradeoff was maintenance. A public forum accepted untrusted input, ran server-side code, and had to stay current when vulnerabilities were disclosed.
The email does not preserve my response. I cannot say whether I accepted the automatic upgrade, protected custom changes first, or handled the installation separately. It also does not record an actual compromise.
It does preserve the operational choice exactly. Take the managed upgrade and risk changes to themes or scripts, or refuse it and accept responsibility for patching quickly. Doing nothing was not a safe option.
The provider scheduled the work. I had one week to check the forum and decide which path to take.