Re: [Emc-developers] Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619

[Bertho S. <lc...@va...>]

On 10/23/26 4:10 PM, Robert Schöftner wrote:
> I think discourse deployment is recommended via the docker image. 
> Maintenance should be limited to keeping the docker image up to date and
> happy. Though I don't really like the "hiding" of all the stuff, docker
> just really is a fancy chroot, and IME it works fine and takes the
> hassle out of keeping up to date with dependencies and security updates.
That would put you in the situation that you download a docker image, 
which you have no control over how it was built. Otherwise, you need to 
rebuild it for every change and are again in the same position I 
described before. It is essentially a >borked< if you do and >borked< if 
you don't situation.

What can be created from the Debian repositories (or other distros)? 
That has generally a long life and a well-defined update/upgrade path. 
It is better to reduce bells and whistles for stability as well as easy 
and ordered system administration.


> discourse itself is GPL2
>   https://github.com/discourse/discourse/blob/main/LICENSE.txt

Yes, it is FOSS. But, its not about the license as such. Its about the 
deployment and the effort it takes to keep it running and up-to-date 
without any data loss, doing so with the available resources.

-- 
Greetings Bertho

(disclaimers are disclaimed)