Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[Stuart S. <st...@gm...>]

Sounds like a job for AI.


Addressee is the intended audience.
If you are not the addressee then my consent is not given for you to read
this email furthermore it is my wish you would close this without saving or
reading, and cease and desist from saving or opening my private
correspondence.
Thank you for honoring my wish.


On Fri, Oct 23, 2026 at 5:33 AM Bertho Stultiens <lc...@va...> wrote:

> >> Maybe then also think about if kunena/joomla really is the way to go
> >> forward, or something a bit more modern (discourse) would be better in
> >> the long run.
>
> Replacing one dependency for a "free" commercial dependency is a bad
> move. To see how bad the idea is to use "free" hosted discourse, just go
> to their license and privacy policy pages and try to make sense of it.
> The "free" always comes with a price.
>
> The only real option is to do self-hosting and assure 1) an isolated
> instance not doing call-backs to any third parties and assured data
> privacy and 2) have a well-defined path from the current forum data to
> the new database, preserving history.
>
> Even then, if you read through the list of things you need to
> install/run it self-hosted, including NPM, then I'm not sure it is a
> good idea at all. Keeping a local install up to data from a git clone is
> hard and it requiring NPM, with a significant history of supply-chain
> attacks, is also a problem. The alternative is to become dependent on
> the commercial vendor, which is just as problematic, especially if you
> want to assure point 1.
>
> So, in the end we trade the PHP problem for multiple new ones. That does
> not sound like a good change.
>
> --
> Greetings Bertho
>
> (disclaimers are disclaimed)
>
>
>
> _______________________________________________
> Emc-developers mailing list
> Emc...@li...
> https://lists.sourceforge.net/lists/listinfo/emc-developers
>