Security issue thread - PHP and eMudhra cert compromise

[karlemilnikka]

@nebulon I see, so we shouldn’t expect being able to take Castopod online for a couple of days (i.e., best to migrate away)?

[nebulon]

might be too early to recommend migrating away, I think a lot of projects struggle currently to keep up simply.

[karlemilnikka]

@nebulon I understand, but after 24 h of downtime and no ETA, it seems like the best choice. Thanks for the quick replies!

[karlemilnikka]

@nebulon Oh, and thanks for the amazing job you and your colleagues have done with many of the other packages!

[timconsidine]

Any thoughts on vulnerabilities allegedly in python and samba ?
https://x.com/markgadala/status/2113385154458583370?s=46

I wrote “allegedly” as I don’t have confirmation.

[humpty]

@timconsidine why does it feel like this is the new norm now because of AI?

[bazinga]

I really hope cloudron team focuses their efforts on running all kinds of AI driven security testing against the platform. Otherwise very soon we may see more serious issues.

[CRBear]

I’d like to take this opportunity to express my sincere appreciation and say a huge thank you for the excellent and highly professional work, particularly in addressing the issues discussed in this thread.

[daebak]

@CRBear You're absolutely right, we're all very concerned about our systems and sometimes we forget about those who work promptly to resolve them. I join you in your thanks, and special thanks as well to the other members who often contribute with valuable answers.

[whitespace]

@bazinga If anything their efforts are already focused on keeping Cloudron secure, which is one of the reasons it exists in the first place. To say "hopefully they will use AI or else" is kinda disrespectful to the project, don't you think? I see where you are coming from though. We live in exponential times.

[timconsidine]

I’d like to take this opportunity to express my sincere appreciation and say a huge thank you for the excellent and highly professional work, particularly in addressing the issues discussed in this thread.

Absolutely !

The only disappointment is that the forum does not have the "send coffee, beer, RedBull, doughnuts, pizza" module enabled. Oh well, hopefully our heartfelt thanks will suffice for now.

Thank you @cloudron

[timconsidine]

Maybe we don't have to worry too much on the samba issue ?

https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

"Running systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active."

[marcusquinn]

Always thought this about Cloudron; anything that's not supposed to be a public website or app should be behind a mesh vpn, hence this research back in Feb 2022, and hope that Netbird can be a support app for vpn gating cloudron apps:

• https://forum.cloudron.io/topic/7571/netbird-foss-noconf-mesh-vpn-using-wireguard-alternative-to-zerotier-tailscale-omniedge-netmaker-etc

Security through invisibility. Buys more time for patching these incidents.

[girish]

Thanks for the kind words, all

Good news - most packages are updated! Just doing a final pass now and making sure we didn't miss any.

[girish]

@marcusquinn yeah, I think so too. The VPN feature in Cloudron 10 was just to get started in that direction.

[jadudm]

1. I know I am adding noise to a thread. I'm doing it anyway.
2. How do I get a SUPER FAN badge?
3. This is why I am glad to pay for Cloudron.
4. Stated less transactionally: this is why I put my trust in the Cloudron team.

I had to respond to these issues as part of my day job. I was incredibly grateful that I did not have to respond to it as part of my home life. I came to the Cloudron site, saw the banner, looked at the first post, and knew it was being handled.

Many, many thanks to the team and community packagers who jumped on this professionally and responsibly.

[girish]

Sending out a newsletter but given the size of the list it might take a while to get to you. Here's the public newsletter https://newsletter.cloudron.io/archive/2026-10-21-php-emudhra

[marcusquinn]

@jadudm it came from this bit of banter:

• https://forum.cloudron.io/post/131061

[andreasdueren]

@marcusquinn Outrageous that I don’t have a Giga Fan badge.

[leighmhart]

@karlemilnikka Castopod has been updated, FYI.