# Discourse affected? CVE-2026-109618 **URL:** \ **Category:** Product Support\ **Created:** [October 21, 2026, 2:39pm UTC](https://meta.discourse.org/t/discourse-affected-cve-2026-109618/415320 "2026-10-21T14:39:01Z")\ **Posts on this page:** 2\ **Page:** 1 ## AI-generated summary The discussion addresses whether Discourse is affected by the recently disclosed CVE-2026-109618 and CVE-2026-109619 vulnerabilities. [Mine_Zcash](/t/-/415320/1) inquires if any action is required for hosted forums, noting that other sites have gone read-only pending patches. [david](/t/-/415320/2) confirms that Discourse is unaffected because it does not use PHP, stating that no action is needed for either self-hosters or hosted customers.
**Author:** ![Mine\_Zcash](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mine_zcash/32/110575_2.png) [@Mine\_Zcash](https://meta.discourse.org/u/Mine_Zcash)\ **Post date:** [October 21, 2026, 2:39pm UTC](https://meta.discourse.org/t/discourse-affected-cve-2026-109618/415320/1 "2026-10-21T14:39:01Z")
Just want to check if Discourse is affected by today’s leak of CVE-2026-109618 and CVE-2026-109619 Several forum sites are going into temporary read-only mode following this disclosure until they are patched, is any action required for our forums that are hosted by Discourse? ---
**Author:** ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)\ **Post date:** [October 21, 2026, 2:42pm UTC](https://meta.discourse.org/t/discourse-affected-cve-2026-109618/415320/2 "2026-10-21T14:42:16Z")
Discourse doesn’t use php, so is unaffected by these issues. No action is required from self-hosters, or from our hosted customers.