# Maintenance notice
**URL:** https://collective.flashbots.net/t/maintenance-notice/156
**Category:** Site Feedback
**Created:** [August 24, 2022, 2:25pm UTC](https://collective.flashbots.net/t/maintenance-notice/156 "2022-08-24T14:25:11Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [August 24, 2022, 2:25pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/1 "2022-08-24T14:25:11Z")
I’m taking the forum down briefly for an upgrade. We will be back soon.
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [August 24, 2022, 2:46pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/2 "2022-08-24T14:46:26Z")
And we are back!
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [September 30, 2022, 2:42am UTC](https://collective.flashbots.net/t/maintenance-notice/156/3 "2022-09-30T02:42:32Z")
I’m upgrading the forum right now…
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [September 30, 2022, 3:04am UTC](https://collective.flashbots.net/t/maintenance-notice/156/4 "2022-09-30T03:04:19Z")
Everything looks good from here. If you see something weird, please yell.
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [April 2, 2024, 6:40pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/5 "2024-04-02T18:40:36Z")
I’m doing maintenance 🛠
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [April 2, 2024, 7:05pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/6 "2024-04-02T19:05:48Z")
@Fred I removed the plugins that are now part of discourse.
Everything went smooth. Let me know if there’s something else to do.
---
### Author:  [@Fred](https://collective.flashbots.net/u/Fred)
#### Post date: [April 3, 2024, 2:56pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/8 "2024-04-03T14:56:56Z")
Thank you! Which plugins have been integrated to Discourse? 🙏
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [April 3, 2024, 3:21pm UTC](https://collective.flashbots.net/t/maintenance-notice/156/9 "2024-04-03T15:21:42Z")
> **[Topics tagged included-in-core](https://meta.discourse.org/tag/included-in-core)**
>
> Topics tagged included-in-core
---
### Author:  [@guayabyte](https://collective.flashbots.net/u/guayabyte)
#### Post date: [September 24, 2026, 9:10am UTC](https://collective.flashbots.net/t/maintenance-notice/156/10 "2026-09-24T09:10:32Z")
### CVE-2026-32882: Collective forum review
#### The vulnerability
CVE-2026-32882 (Discourse advisory [GHSA-vhm9-85gw-x335](https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335), CVSS 8.8) is a memory-corruption bug in **libheif** , the system library Discourse uses to process HEIC/HEIF/AVIF images. Anyone with an account that can upload images could run code on the server by uploading a crafted image. The fix ships in Discourse 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6, but it only reaches a server when the Docker container is rebuilt.
It became widely known when researchers used it to take over OpenAI’s Discourse forum. Because that forum was tied to OpenAI’s staff sign-in, they reached staff ChatGPT and Codex accounts and one internal repository.
#### What we updated
- **Upgraded** [collective.flashbots.net](http://collective.flashbots.net) to Discourse 2026.10.0 with `./launcher rebuild app`.
- **Confirmed** the patched libheif is installed in the running container, not only in Discourse’s code.
- **Removed** `heic`, `heif` and `avif` from the authorized upload extensions.
#### What we checked
Everything came back clean:
- **Uploads:** no HEIC/HEIF/AVIF uploads in the last six months, and no PNG/JPG/GIF/WebP files that were really HEIF/AVIF inside. We checked the files’ actual contents, not just their names.
- **Deleted uploads:** no disguised HEIF/AVIF files in the tombstone folder.
- **Accounts and access:** no unexpected admins, moderators, API keys, webhooks, or theme or site-setting changes.
- **Crash logs:** no image-processing crashes in the logs still on disk.
- **Server:** no leftover scripts, cron jobs or unexpected SSH keys in persistent storage or on the host.
- **Identity:** the forum isn’t connected to internal Flashbots logins, so the route that made the OpenAI case serious doesn’t exist here.
#### Outcome
The forum is patched and we found no sign of exploitation. Rotating `SECRET_KEY_BASE`, which logs everyone out, and reviewing any powerful credentials stored on the server are optional precautions.
* * *
_Created together with [Claude Opus 5.5](https://claude.ai/artifact/NBawj3RSojzKcpKQLFTZwb)_ 🛡🔍