Apparently version 2.0.11 of phpBB is not vulnerable to the Santy worm. That's according to the description of the apparent vulnerability ("viewtopic.php highlight") posted to Securiteam's site.
Users of older versions might want to check out these tips posted to phpBB's own forum.
