Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[Robert S. <rm...@un...>]

Am Freitag, dem 23.10.2026 um 12:32 +0200 schrieb Bertho Stultiens:
> > > Maybe then also think about if kunena/joomla really is the way to
> > > go
> > > forward, or something a bit more modern (discourse) would be
> > > better in
> > > the long run.
> 
> Replacing one dependency for a "free" commercial dependency is a bad 
> move. To see how bad the idea is to use "free" hosted discourse, just
> go 
> to their license and privacy policy pages and try to make sense of
> it. 
> The "free" always comes with a price.
> 
> The only real option is to do self-hosting and assure 1) an isolated 
> instance not doing call-backs to any third parties and assured data 
> privacy and 2) have a well-defined path from the current forum data
> to 
> the new database, preserving history.
> 

I agree self-hosting is the way to go. Either way, we have to take
measures to avoid another semi-permanent "wiki certificate"-situation
that can only be fixed with a time-machine or spooky action at a
distance through a wormhole. 

> Even then, if you read through the list of things you need to 
> install/run it self-hosted, including NPM, then I'm not sure it is a 
> good idea at all. Keeping a local install up to data from a git clone
> is 
> hard and it requiring NPM, with a significant history of supply-chain
> attacks, is also a problem. The alternative is to become dependent on
> the commercial vendor, which is just as problematic, especially if
> you 
> want to assure point 1.
> 
> So, in the end we trade the PHP problem for multiple new ones. That
> does 
> not sound like a good change.
> 

I think discourse deployment is recommended via the docker image.
Maintenance should be limited to keeping the docker image up to date
and happy. Though I don't really like the "hiding" of all the stuff,
docker just really is a fancy chroot, and IME it works fine and takes
the hassle out of keeping up to date with dependencies and security
updates.

discourse itself is GPL2
 https://github.com/discourse/discourse/blob/main/LICENSE.txt
-- 
Robert Schöftner <rm...@un...>