Elgg 1.8 is very mature. After all it has received 20 patch releases. (You should update at least to 1.8.20 btw!)

But in the end it's difficult to say. None of us core devs are looking for security issues from 1.8. Maybe there still are some exploitable issues, maybe not.

With approval from the rest of the core team, I'd be happy to review and accept security PRs for the 1.8 branch (we just won't tag anymore releases or formerly support it). It might be wise to join forces with other 1.8 users to make sure newer security commits get backported quickly.

I need security update for elgg 1.9 the last one is 1.9.8 & then no security issues i doubt that ... I really don't like the way elgg is rushing in to there new release.. They need to give time for plugin developers & also some time for websites that are really running with huge data's i have already said this but the elgg team doesn't seems to be considering these problems.. They need to slow down on new releases.. The new releases are only benefiting new elgg users not for the old users i liked the way elgg 1.9 got times to get in to upgrade but not 1.10 or the presiding elgg releases which was much faster & i cant be frequently customizing my elgg website for every new release.. When a time comes for huge websites to upgrade it will become a huge headache to find those plugins & also making the upgrade process tedious..

Do you have any specific issues with upgrading to higher version than 1.9? Since we adopted semver, in theory you shouldn't have problems upgrading. I wonder what's holding you up at 1.9?

Transition from 1.8 to 1.9 has been quite traumatic as far as the upgrade of the plugins concerned. But it is hard to go forward by keeping backward compatibility all the time. With the release 1.10, the significance of the minor version has diminished. So if you have made it to 1.9, you should be able to go up the latest version (1.12.x) without much hassle (probably still 1 or 2 plugins will be left behind, but nowhere like 1.9 upgrade).

I disagree that the new versions only benefit new users. As for the frustration with the new versions of the plugins; probably some sort of crowdfunding is the only option to get them keep up with the new Elgg versions.

I am not complaining on elgg new frequent releases what i am trying to say is elgg should maintain a separate standardize(LTS) release. So that even the plugin developers can maintain there plugin & elgg websites can also keep up with the upcoming elgg releases. upgrading from 1.9 to 1.12 is not a big deal & @ the same time elgg team should know its not an OS where you can downgrade your upgrade when you like so it always takes time for websites to check and go for a new upgrade if its 1.9.12 you know it's not going to be any massive change but when it comes to 1.12 you have a lot of steps to follow before upgrade bcz no one wants to end in crash while upgrading. So i hope the elgg team understands & upgrade elgg in 3 type as all CMS do

1)LTS(Long Time Support),

2)NR or RC (New Releases)

3)Beta Release   

This type of upgrade can remove lot of confusion & it will also be benefiting for the community i hope elgg team understands what i am trying to say. I am happy with the new release & i am happy with elgg getting better day by day but not happy with the method the elgg is been released. 

1.8 will be 4 years old on Saturday.  I'd say that's pretty long term :)

I am not complaining on 1.8 releases i am complaining on 1.10 & presiding releases for eg if you search for elgg 1.8 you will have massive plugins & there are so many websites still in elgg 1.8 but if you check 1.9 or the presiding elgg releases it does not hold much..  Elgg should change there way of releasing new elgg having a standardize elgg release & new release separately can solve much of the problem.

The New Releases will be useful in making an standardize elgg mature in every way. That's why i am requesting the elgg team to release elgg in 3 type.

Most of my plugins will not run on 1.9 mostly due to the custom theme I developed. I tried an upgrade on a staging server where more than half the plugins, including core plugins like files and groups, returned the "PluginException:CannotStart" error.

They need to give time for plugin developers & also some time for websites that are really running with huge data's i have already said this but the elgg team doesn't seems to be considering these problems.

This is a common issue in all CMS. Eventually new and better plugins will be developed, just need to be patient.

I encourage you to upgrade to the latest version, to take advantage of all the new features that elgg has now. It takes time and effort to get everything working as expected, but in the end it is worth it.