Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[Bertho S. <lc...@va...>]

>> Maybe then also think about if kunena/joomla really is the way to go
>> forward, or something a bit more modern (discourse) would be better in
>> the long run.

Replacing one dependency for a "free" commercial dependency is a bad 
move. To see how bad the idea is to use "free" hosted discourse, just go 
to their license and privacy policy pages and try to make sense of it. 
The "free" always comes with a price.

The only real option is to do self-hosting and assure 1) an isolated 
instance not doing call-backs to any third parties and assured data 
privacy and 2) have a well-defined path from the current forum data to 
the new database, preserving history.

Even then, if you read through the list of things you need to 
install/run it self-hosted, including NPM, then I'm not sure it is a 
good idea at all. Keeping a local install up to data from a git clone is 
hard and it requiring NPM, with a significant history of supply-chain 
attacks, is also a problem. The alternative is to become dependent on 
the commercial vendor, which is just as problematic, especially if you 
want to assure point 1.

So, in the end we trade the PHP problem for multiple new ones. That does 
not sound like a good change.

-- 
Greetings Bertho

(disclaimers are disclaimed)