Security issue thread - PHP and eMudhra cert compromise
-
- I know I am adding noise to a thread. I'm doing it anyway.
- How do I get a SUPER FAN badge?
- This is why I am glad to pay for Cloudron.
- Stated less transactionally: this is why I put my trust in the Cloudron team.
I had to respond to these issues as part of my day job. I was incredibly grateful that I did not have to respond to it as part of my home life. I came to the Cloudron site, saw the banner, looked at the first post, and knew it was being handled.
Many, many thanks to the team and community packagers who jumped on this professionally and responsibly.
@jadudm it came from this bit of banter:
Web Design & Development: https://www.evergreen.je
Technology & Apps: https://www.marcusquinn.com -
@jadudm it came from this bit of banter:
@marcusquinn Outrageous that I don’t have a
Giga Fanbadge. -
@nebulon I understand, but after 24 h of downtime and no ETA, it seems like the best choice. Thanks for the quick replies!
@karlemilnikka Castopod has been updated, FYI.
-
In the original post:
This should say 20260816ubuntu0.26.04.1 atleast. The first part is the date, and it must be **later** than that.should probably say 'equal or later than that'.
-
Sending out a newsletter but given the size of the list it might take a while to get to you. Here's the public newsletter https://newsletter.cloudron.io/archive/2026-10-21-php-emudhra
@girish The newsletter reads as if all packages have been updated. At least Wallabag is not as far as I can tell. Am I reading it wrong?
-
@girish The newsletter reads as if all packages have been updated. At least Wallabag is not as far as I can tell. Am I reading it wrong?
-
@girish The newsletter reads as if all packages have been updated. At least Wallabag is not as far as I can tell. Am I reading it wrong?
@whitespace https://github.com/wallabag/wallabag/pull/9099 (tldr upstream code hasn't been updated for a while and they have to make an upstream release first)
-
@whitespace https://github.com/wallabag/wallabag/pull/9099 (tldr upstream code hasn't been updated for a while and they have to make an upstream release first)
@joseph Thanks, I am aware. I just wanted to point out that the newsletter statement 1. can be understood otherwise.
-
Hello @whitespace
I managed to resolve the issue and the update is released https://forum.cloudron.io/topic/3936/wallabag-package-updates/39 -
Hello @whitespace
I managed to resolve the issue and the update is released https://forum.cloudron.io/topic/3936/wallabag-package-updates/39@james So much appreciation! I love this community.
-
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
-
-
For critical update, should we create a feature to immediately update apps like within or less than 5-minutes after the patch is released?
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
Yes, I wondered about this too.
At present stopped apps cannot be updated. I'm not entirely clear why that is?
It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.
-
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
Yes, I wondered about this too.
At present stopped apps cannot be updated. I'm not entirely clear why that is?
It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
Yes, I wondered about this too.
At present stopped apps cannot be updated. I'm not entirely clear why that is?
It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.
@jdaviescoates Last week, I learned about two options:
- Apps that run protected by a VPN
- Apps that run in recovery mode
Both options work. Option 2 is the right approach if a security vulnerability works on ports other than 80 and 443.
Pronouns: he/him | Primary language: German
-
@jdaviescoates Last week, I learned about two options:
- Apps that run protected by a VPN
- Apps that run in recovery mode
Both options work. Option 2 is the right approach if a security vulnerability works on ports other than 80 and 443.
+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
-
+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login