Security issue thread - PHP and eMudhra cert compromise
-
-
-
-
@girish Thanks a lot, I did manually. But I cannot figure out why not was automatically updated...
-
-
@girish is there a handy list somewhere of which Cloudron packages are PHP?
@jdaviescoates according to chatgpt the following are php based (not a complete list):
- nextcloud
- roundcube
- wordpress
- freescout
- yourls
- Invoiceninja
edit: I know you also use navidrome (not php). N8n, Joplin, Vaultwarden are all safe (non-php based).
-
There are two major security issues that hit today morning.
- eMudhra Certificate compromise - https://emudhra.we-have-a-problem.com
- PHP issue - https://cert.europa.eu/publications/security-advisories/2026-018/ . The recommendation here is to shut down your PHP sites entirely. FWIW, we have shutdown our own matomo, freescout, mautic, humhub .
We are also updating https://social.cloudron.io/@cloudron and https://x.com/CloudronIO as we get more information. Public newsletter link - https://newsletter.cloudron.io/archive/2026-10-21-php-emudhra
PHP RCE
We have already started rolling out updates for the apps.
Status as of 22 OCT 19:20 CEST - Around 175 packages have been updated. ~20 or so remain. We are working through them diligently. It's complicated because sometimes upstream has gone all silent.
Status as of 23 OCT 9:20 CEST - Pretty much all packages updated. Only 3-4 remain. All PHP apps are updated.
eMudhra Certificate compromise
Ubuntu has released the necessary CA store update - https://ubuntu.com/security/notices/USN-8944-1 . All Cloudron packages have been updated to include the new CA store.
Cloudron already enables automatic security updates on the server. But you can and should check this manually.
SSH into your server and run:
# dpkg-query -W -f 'installed: ${Version}\n' ca-certificates installed: 20260816ubuntu0.26.04.1This should say
20260816ubuntu0.26.04.1atleast. The first part is the date, and it must be equal to or later than that. The last part of the string will differ based on your ubuntu version (for example,20260816ubuntu0.22.04.1is valid).You can check when the above package arrived via automatic security update:
# grep -A2 'ca-certificates' /var/log/apt/history.log | tail -n 2 Upgrade: ca-certificates:amd64 (20260601~26.04.1, 20260816ubuntu0.26.04.1) End-Date: 2026-10-21 06:59:55If the ca-certificates was not updated, update ca-certificates package manually:
# apt-get update # apt-get install -y ca-certificatesNow to be 100% sure, check that the cert is not in trust bundle:
# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout | grep -F "emSign ECC Root CA - G3" && echo "STILL IN TRUST BUNDLE" || echo "removed from trust bundle"It should say
removed from trust bundleCloudron update
Cloudron 10.1.6 is coming soon with an update to nodejs - https://github.com/nodejs/node/releases/tag/v24.22.1 (via this change). You should update to Cloudron 10.1.6 at the earliest, when it's available. Other parts of Cloudron like nginx, docker will use the host CA bundle automatically and are safe. At this point, there is nothing you (the user) can do until we release this.
New base images
This section is for packagers.
New images:
cloudron/base:6.0.1@sha256:7b1e729960c3ca312d26e886917ba89483241bba0219ff292858e10d9d5768ee
cloudron/node-base:24-20261021@sha256:7435d8aca138ce01cfca4cd7ec05683223b8f5d7198c9abdaaefa1b6ba14b4c6(Per https://nodejs.org/en/blog/vulnerability/october-2026-security-releases , Node.js v22.23.4, Node.js v24.22.1
Node.js v26.12.1 are updated)I am investigating python. Per https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576, ensure pip >= 26.2.2 .
PHP versions are out -PHP 8.5.12 , PHP 8.4.27 , PHP 8.3.36
PHP 8.2.35 . We are building new packages . Special thanks tooerdnjfrom https://codeberg.org/oerdnj/deb.sury.org/issues/145New base images:
cloudron/php-base:8.5-20261021andcloudron/php-base:8.4-20261021 -
-
-
@girish is there a handy list somewhere of which Cloudron packages are PHP?
@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourlsPronouns: he/him | Primary language: German
-
@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourls@jdaviescoates as fas as i know:
2fauth
ampache
bookstack
castopod
dokuwiki
dolibarr
easyappointments
espocrm
firefly-iii
freescout
freshrss
glpi
grav
humhub
invoiceninja
jirafeau
kanboard
kimai
koel
leantime
limesurvey
lychee
matomo
mautic
mediawiki
monica
moodle
nextcloud
omeka-s
opodsync
osticket
piwigo
pixelfed
privatebin
roundcube
rss-bridge
shaarli
snappymail
snipeit
tachyon
tinytinyrss
wallabag
wallos
wordpress-developer
wordpress-managed
xbackbone
yourlsThanks, I was about to post the same list. Plus LAMP.
-
I've just installed Cloudron CLI and stopped all my PHP apps for good measure (with the help of Claude)
-
@jdaviescoates Another “workaround” could be to install VPN app and mark as required to access to all installed application. What do you think? Could be a temporary workaround to avoid to stop every app?
-
@jdaviescoates Another “workaround” could be to install VPN app and mark as required to access to all installed application. What do you think? Could be a temporary workaround to avoid to stop every app?
-
-
J joseph referenced this topic
-
@girish will/can there a patch for Cloudron <10 users? I have a LAMP which requires MYSQL 8.0, that's why I haven't upgraded to 9.2.0 yet, to avoid compatibility issues with MYSQL 8.4
Edit: Might opt for a custom app, that's not a healthy way to maintain that LAMP app
Unrelated: Great response time and effort for the fixes, much appreciated!
-
I powered off my netcup Cloudron servers a few hours ago and I´m now browsing through the forum, gathering info.
Would this be a sensible restart procedure, once cloudron and package updates are available?- Before booting, restrict inbound access at the provider firewall to my IP only (SSH/HTTPS, covering IPv4 and IPv6), initially blocking other outbound traffic except administrative replies - if possible
- Boot normally and stop all apps through the dashboard.
- Allow the outbound connectivity needed for updates (no idea how..), verify/update Ubuntu’s ca-certificates, and install Cloudron 10.1.6 when available as laid out in @girish´s first post
- Update and test app packages individually once available, keeping unpatched apps stopped before restoring public access.
Would this make preventing Docker from starting during boot unnecessary? Also, is restricting inbound access sufficient for temporary operation, or should apps awaiting CA/runtime fixes remain stopped because of their outbound TLS connections?
Thank you guys being as fast and commited as you are
-
How to receive the PHP fix ? I don't see any updates?
Do I need to stop my PHP apps ?He/Him - Native language: French
-
How to receive the PHP fix ? I don't see any updates?
Do I need to stop my PHP apps ?@sebastienserre Individual PHP apps will need to be updated. I just noticed that WordPress has been updated but others aren't yet. It sounds like the automated systems are still testing and building updates and they'll be ready soon.
-
How to receive the PHP fix ? I don't see any updates?
Do I need to stop my PHP apps ?@sebastienserre yes, it's best to stop the PHP-based apps. You can see which apps are affected a few posts up. App updates are being rolled out. For instance, Wordpress and Freescout fixes are ready. As for the server, go to the initial post, log in to your server(s) via SSH, and run the commands to make sure the server is up to date. That's all you need to do right now.
and thanks for all your efforts
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login