The discussion addresses whether Discourse is affected by the recently disclosed CVE-2026-109618 and CVE-2026-109619 vulnerabilities. Mine_Zcash inquires if any action is required for hosted forums, noting that other sites have gone read-only pending patches. david confirms that Discourse is unaffected because it does not use PHP, stating that no action is needed for either self-hosters or hosted customers.
Just want to check if Discourse is affected by today’s leak of CVE-2026-109618 and CVE-2026-109619
Several forum sites are going into temporary read-only mode following this disclosure until they are patched, is any action required for our forums that are hosted by Discourse?
Discourse doesn’t use php, so is unaffected by these issues. No action is required from self-hosters, or from our hosted customers.