Security issue thread - PHP and eMudhra cert compromise

[girish]

There are two major security issues that hit today morning.

• eMudhra Certificate compromise - https://emudhra.we-have-a-problem.com
• PHP issue - https://cert.europa.eu/publications/security-advisories/2026-018/ . The recommendation here is to shut down your PHP sites entirely. FWIW, we have shutdown our own matomo, freescout, mautic, humhub .

We are also updating https://social.cloudron.io/@cloudron and https://x.com/CloudronIO as we get more information. Public newsletter link - https://newsletter.cloudron.io/archive/2026-10-21-php-emudhra

PHP RCE

We have already started rolling out updates for the apps.

Status as of 22 OCT 19:20 CEST - Around 175 packages have been updated. ~20 or so remain. We are working through them diligently. It's complicated because sometimes upstream has gone all silent.

Status as of 23 OCT 9:20 CEST - Pretty much all packages updated. Only 3-4 remain. All PHP apps are updated.

eMudhra Certificate compromise

Ubuntu has released the necessary CA store update - https://ubuntu.com/security/notices/USN-8944-1 . All Cloudron packages have been updated to include the new CA store.

Cloudron already enables automatic security updates on the server. But you can and should check this manually.

SSH into your server and run:

# dpkg-query -W -f 'installed: ${Version}\n' ca-certificates
installed: 20260816ubuntu0.26.04.1

This should say 20260816ubuntu0.26.04.1 atleast. The first part is the date, and it must be equal to or later than that. The last part of the string will differ based on your ubuntu version (for example, 20260816ubuntu0.22.04.1 is valid).

You can check when the above package arrived via automatic security update:

# grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n 2
Upgrade: ca-certificates:amd64 (20260601~26.04.1, 20260816ubuntu0.26.04.1)
End-Date: 2026-10-21  06:59:55

If the ca-certificates was not updated, update ca-certificates package manually:

# apt-get update
# apt-get install -y ca-certificates

Now to be 100% sure, check that the cert is not in trust bundle:

# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt  | openssl pkcs7 -print_certs -noout | grep -F "emSign ECC Root CA - G3"   && echo "STILL IN TRUST BUNDLE" || echo "removed from trust bundle"

It should say removed from trust bundle

Cloudron update

Cloudron 10.1.6 is coming soon with an update to nodejs - https://github.com/nodejs/node/releases/tag/v24.22.1 (via this change). You should update to Cloudron 10.1.6 at the earliest, when it's available. Other parts of Cloudron like nginx, docker will use the host CA bundle automatically and are safe. At this point, there is nothing you (the user) can do until we release this.

New base images

This section is for packagers.

New images:

cloudron/base:6.0.1@sha256:7b1e729960c3ca312d26e886917ba89483241bba0219ff292858e10d9d5768ee
cloudron/node-base:24-20261021@sha256:7435d8aca138ce01cfca4cd7ec05683223b8f5d7198c9abdaaefa1b6ba14b4c6 (Per https://nodejs.org/en/blog/vulnerability/october-2026-security-releases , Node.js v22.23.4, Node.js v24.22.1
Node.js v26.12.1 are updated)

I am investigating python. Per https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576, ensure pip >= 26.2.2 .

PHP versions are out -PHP 8.5.12 , PHP 8.4.27 , PHP 8.3.36
PHP 8.2.35 . We are building new packages . Special thanks to oerdnj from https://codeberg.org/oerdnj/deb.sury.org/issues/145

New base images: cloudron/php-base:8.5-20261021 and cloudron/php-base:8.4-20261021

[girish]

I am writing this thread, as we work on it . Apologies for any typos, much frenzy If you leave a note, I will correct any issues.

[nebulon]

So https://www.php.net/index.php#2026-10-20-1 covers all the details now. Also the packages we depend on have already been rebuilt https://codeberg.org/oerdnj/deb.sury.org/issues/145

[humpty]

This post is deleted!

[p44]

@girish on different Cloudron instances I ran

# dpkg-query -W -f 'installed: ${Version}\n' ca-certificates

I had older version, I updated.

Why wasn't it updated, even though Cloudron should have updated it?

[girish]

@p44 the automatic security update comes from ubuntu itself. All our instances updated automatically. You can still update manually (see the main post). You can check /var/log/apt/history.log on the history of automatic updates. But do this manually:

# apt-get update
# apt-get install -y ca-certificates

[p44]

@girish Thanks a lot, I did manually. But I cannot figure out why not was automatically updated...

[humpty]

Is the new cloudron "mail" app php based?

[girish]

@humpty all our apps are node.js based .

[nebulon]

@p44 this could just be that the cron job didn't run yet on your instance.

[jdaviescoates]

@girish is there a handy list somewhere of which Cloudron packages are PHP?

[humpty]

@jdaviescoates according to chatgpt the following are php based (not a complete list):

• nextcloud
• roundcube
• wordpress
• freescout
• yourls
• Invoiceninja

edit: I know you also use navidrome (not php). N8n, Joplin, Vaultwarden are all safe (non-php based).

[jdaviescoates]

@girish said:

grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n

that's missing a number at the end. I went for:

grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n 3

[p44]

@nebulon Thanks Nebulon and thanks for all your efforts

[msbt]

there used to be a filter like https://git.cloudron.io/packages?filter=php that worked, but not anymore apparently

[luckow]

@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourls

[jdaviescoates]

@luckow said:

@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourls

Thanks, I was about to post the same list. Plus LAMP.

[jdaviescoates]

I've just installed Cloudron CLI and stopped all my PHP apps for good measure (with the help of Claude)

[p44]

@jdaviescoates Another “workaround” could be to install VPN app and mark as required to access to all installed application. What do you think? Could be a temporary workaround to avoid to stop every app?

[jdaviescoates]

@p44 I don't have the knowledge to know tbh. But it sounds a bit like what more qualified @fbartels described in that other thread.