Been working on it flat out. Lots of fairly big code pieces are getting done at the moment. Mostly backend stuff, like a proper ip to name function that doesn't block a page for minutes at a time, integrating maxminds geoip ip to country, fully working utf-8 support, url/ip/email validation are all done.
Also done a whois lookup page for mods, so they can click an IP and see the ISP name etc, even when PTR lookups fail.
Security is mostly done. Auto logouts when your cookies are used from a different address, blocking of brute force attempts on login/cookie login/password recovery/email change validation etc. Currently adding in a session based verification for mod functions to prevent mods being tricked into doing something from an external link.
I'm putting in some intelligent caching, whereby the cache is actually a php file. An example of where it's useful, a profile page. Normally, you want certain parts of a profile only accessable to staff, like mod comments. If you cache the HTML output, it's either missing the staff parts, or they become accessable to everyone. Storing as a php file allows us to keep the seperation while storing all the data preloaded and preparsed.
Works nicely on the news page as well, where you have a lot of bbcode() calls that can be cut down by caching but also want links to edit/delete only for admins.
It has 2 stage access control. There are mod/torrent mod/admin and sysop flags for classes, as well as class numbers. You can have a sysop at class number 1000 say, and an admin at 2000. The admin still only gets admin access, but can alter the sysops account. It allows you to make a coder class with sysop privs (can see everything), but have the coders account settings accessable to the admins.
I've built a setup script for it, which should run you through everything easily. All that needs doing on that is plugging in the sql queries once the code is finished.
Been building this one on windows with php4, and testing with linux and php5. Testing on apache and lighttpd. It should be more reliable, although it might be better running it on a VPS or paid for webspace rather than free space.
This version will be definately aimed towards private sites. Once this is finished with, I can start replacing the private stuff with public stuff.