Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618and CVE-2026-109619

[Gene H. <ghe...@sh...>]

On 10/23/26 06:32, Bertho Stultiens wrote:
>>> Maybe then also think about if kunena/joomla really is the way to go
>>> forward, or something a bit more modern (discourse) would be better in
>>> the long run.
>
> Replacing one dependency for a "free" commercial dependency is a bad 
> move. To see how bad the idea is to use "free" hosted discourse, just 
> go to their license and privacy policy pages and try to make sense of 
> it. The "free" always comes with a price.
>
> The only real option is to do self-hosting and assure 1) an isolated 
> instance not doing call-backs to any third parties and assured data 
> privacy and 2) have a well-defined path from the current forum data to 
> the new database, preserving history.
>
> Even then, if you read through the list of things you need to 
> install/run it self-hosted, including NPM, then I'm not sure it is a 
> good idea at all. Keeping a local install up to data from a git clone 
> is hard and it requiring NPM, with a significant history of 
> supply-chain attacks, is also a problem. The alternative is to become 
> dependent on the commercial vendor, which is just as problematic, 
> especially if you want to assure point 1.
>
> So, in the end we trade the PHP problem for multiple new ones. That 
> does not sound like a good change.
I'm with Bertho.  Fix the PHP but move it to our control.  The last time 
I looked at the PHP docs it was pretty straight forward.

-- 
There are 4 boxes to defend liberty
Soap, ballot, jury, ammo
Please use in that order