Security issue thread - PHP and eMudhra cert compromise

[timconsidine]

Maybe we don't have to worry too much on the samba issue ?

https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

"Running systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active."

[marcusquinn]

Always thought this about Cloudron; anything that's not supposed to be a public website or app should be behind a mesh vpn, hence this research back in Feb 2022, and hope that Netbird can be a support app for vpn gating cloudron apps:

• https://forum.cloudron.io/topic/7571/netbird-foss-noconf-mesh-vpn-using-wireguard-alternative-to-zerotier-tailscale-omniedge-netmaker-etc

Security through invisibility. Buys more time for patching these incidents.

[girish]

Thanks for the kind words, all

Good news - most packages are updated! Just doing a final pass now and making sure we didn't miss any.

[girish]

@marcusquinn yeah, I think so too. The VPN feature in Cloudron 10 was just to get started in that direction.

[jadudm]

1. I know I am adding noise to a thread. I'm doing it anyway.
2. How do I get a SUPER FAN badge?
3. This is why I am glad to pay for Cloudron.
4. Stated less transactionally: this is why I put my trust in the Cloudron team.

I had to respond to these issues as part of my day job. I was incredibly grateful that I did not have to respond to it as part of my home life. I came to the Cloudron site, saw the banner, looked at the first post, and knew it was being handled.

Many, many thanks to the team and community packagers who jumped on this professionally and responsibly.

[girish]

Sending out a newsletter but given the size of the list it might take a while to get to you. Here's the public newsletter https://newsletter.cloudron.io/archive/2026-10-21-php-emudhra

[marcusquinn]

@jadudm it came from this bit of banter:

• https://forum.cloudron.io/post/131061

[andreasdueren]

@marcusquinn Outrageous that I don’t have a Giga Fan badge.

[leighmhart]

@karlemilnikka Castopod has been updated, FYI.

[DidierMalenfant]

In the original post:

This should say 20260816ubuntu0.26.04.1 atleast. The first part is the date, and it must be **later** than that.

should probably say 'equal or later than that'.

[whitespace]

@girish The newsletter reads as if all packages have been updated. At least Wallabag is not as far as I can tell. Am I reading it wrong?

[james]

Hello @whitespace

There are currently issues with the @wallabag PHP update we are currently working on to resolve.
When this is done, the update will be available.

[joseph]

@whitespace https://github.com/wallabag/wallabag/pull/9099 (tldr upstream code hasn't been updated for a while and they have to make an upstream release first)

[whitespace]

@joseph Thanks, I am aware. I just wanted to point out that the newsletter statement 1. can be understood otherwise.

[james]

Hello @whitespace
I managed to resolve the issue and the update is released https://forum.cloudron.io/topic/3936/wallabag-package-updates/39

[whitespace]

@james So much appreciation! I love this community.

[odie]

Just want to add to the appreciation here. Very well done, guys, thank you very much!

[dsp76]

One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?

[DidierMalenfant]

@odie said:

Just want to add to the appreciation here. Very well done, guys, thank you very much!

Same here. Thank you so much for all the hard work!

[IniBudi]

For critical update, should we create a feature to immediately update apps like within or less than 5-minutes after the patch is released?