An Urgent Moodle Upgrade Notice — Upgrading is a Must!
Moodle released an urgent upgrade notice today, two weeks after this post.
To upgrade your Moodle 1.9.x or 1.8.x branch installs, see the following information published today on moodle.org:
http://docs.moodle.org/en/Moodle_1.9.7_release_notes
http://docs.moodle.org/en/Moodle_1.8.11_release_notes
In addition, if you are among the tens of thousands of people using the 1.7 or 1.6 branches (which, as of today, are still being offered for download on moodle.org), it seems support has been discontinued for those branches and there is no fix for your sites. Upgrading is your only option.
Update: The following was posted to the web less than an hour after the “Advanced notice to admins” email was sent out.
http://gctefriends.blogspot.com/2009/11/urgent-moodle-releases-197-and-1811-are.html
http://pastebin.ca/raw/1687668
Just three of several places where this is already posted on the web. By this weekend, it will be all over the web.
Advanced email notice to moodle admins is a myth! It’s a nice theory, but doesn’t translate into practice.
Advanced email notice to Moodle admins, that, by Moodle’s own figures reach 0.001666% of the user-base does not work. Additionally, it’s Thanksgiving day in the US. If an admin in the US does get that email, he/she will probably read it 5 days from now on Monday.
If Moodle wants to send these notices out to an email list, that anyone can sign-up on with no verification of their identity, then that’s great, but in addition, these notices should be plastered across the moodle.org homepage…a place where Moodle users frequent! And every Moodle blogger should be encouraged to post this information to their blogs…blogs Moodle users read! Shouldn’t Moodle users be given at least as much advanced notice as hackers who may be subscribed to that “advanced notice” list?
Important information like this could be posted on the moodle.org homepage, right above the Moodle Business Partner advertisements. This is just a friendly (common sense) suggestion to consider if Moodle really wants to get this kind of urgent information out to as many of their users as possible in a timely manner.
Related posts:
- Moodle Security Notice — An Irresponsbile Process! Tweet Moodle released the following security vulnerability notice today following...
- More Major Moodle Security Vulnerabilities Discovered Tweet Moodle, the open source learning management system, has been...
- WordPress 3.0.3 Released — Moodle, Are You Paying Attention? Tweet WordPress 3.0.3 is available and is a security update...

Moodle “setting a good example” when it comes to security?. That’s debatable, but if they are at least trying, then good for them…some would say that is long over-due.
http://helenfoster.wordpress.com/2009/11/30/demo-site-security-improvements/