Maintenance notice

Site Feedback
1

I’m taking the forum down briefly for an upgrade. We will be back soon.

2

And we are back!

3

I’m upgrading the forum right now…

4

Everything looks good from here. If you see something weird, please yell.

5

I’m doing maintenance :hammer_and_wrench:

6

@Fred I removed the plugins that are now part of discourse.

Everything went smooth. Let me know if there’s something else to do.

1 Like
8

Thank you! Which plugins have been integrated to Discourse? :pray:

9
1 Like
10

CVE-2026-32882: Collective forum review

The vulnerability

CVE-2026-32882 (Discourse advisory GHSA-vhm9-85gw-x335, CVSS 8.8) is a memory-corruption bug in libheif, the system library Discourse uses to process HEIC/HEIF/AVIF images. Anyone with an account that can upload images could run code on the server by uploading a crafted image. The fix ships in Discourse 2026.7.0, 2026.6.1, 2026.5.2 and 2026.1.6, but it only reaches a server when the Docker container is rebuilt.

It became widely known when researchers used it to take over OpenAI’s Discourse forum. Because that forum was tied to OpenAI’s staff sign-in, they reached staff ChatGPT and Codex accounts and one internal repository.

What we updated

  • Upgraded collective.flashbots.net to Discourse 2026.10.0 with ./launcher rebuild app.
  • Confirmed the patched libheif is installed in the running container, not only in Discourse’s code.
  • Removed heic, heif and avif from the authorized upload extensions.

What we checked

Everything came back clean:

  • Uploads: no HEIC/HEIF/AVIF uploads in the last six months, and no PNG/JPG/GIF/WebP files that were really HEIF/AVIF inside. We checked the files’ actual contents, not just their names.
  • Deleted uploads: no disguised HEIF/AVIF files in the tombstone folder.
  • Accounts and access: no unexpected admins, moderators, API keys, webhooks, or theme or site-setting changes.
  • Crash logs: no image-processing crashes in the logs still on disk.
  • Server: no leftover scripts, cron jobs or unexpected SSH keys in persistent storage or on the host.
  • Identity: the forum isn’t connected to internal Flashbots logins, so the route that made the OpenAI case serious doesn’t exist here.

Outcome

The forum is patched and we found no sign of exploitation. Rotating SECRET_KEY_BASE, which logs everyone out, and reviewing any powerful credentials stored on the server are optional precautions.

Created together with Claude Opus 5.5 :shield::magnifying_glass_tilted_left:

1 Like