Security issue thread - PHP and eMudhra cert compromise
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
Yes, I wondered about this too.
At present stopped apps cannot be updated. I'm not entirely clear why that is?
It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.
-
One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?
Yes, I wondered about this too.
At present stopped apps cannot be updated. I'm not entirely clear why that is?
It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.
@jdaviescoates Last week, I learned about two options:
- Apps that run protected by a VPN
- Apps that run in recovery mode
Both options work. Option 2 is the right approach if a security vulnerability works on ports other than 80 and 443.
Pronouns: he/him | Primary language: German
-
@jdaviescoates Last week, I learned about two options:
- Apps that run protected by a VPN
- Apps that run in recovery mode
Both options work. Option 2 is the right approach if a security vulnerability works on ports other than 80 and 443.
+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
-
+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
-
+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
Relatively impossible to estimate. Usually, vulnerability scanners don't check whether your application runs or not. They simply send requests indefinitely, until they have a hit.
Anyhow, updating stopped apps isn't technically feasible.
-
From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
Relatively impossible to estimate. Usually, vulnerability scanners don't check whether your application runs or not. They simply send requests indefinitely, until they have a hit.
Anyhow, updating stopped apps isn't technically feasible.
-
@Lanhild What if the app gets started when an update is available, but the network gets disconnected somehow. Maybe by killing the nginx/proxy/ports temporarily? There's got to be a virtual equivalent to "cutting the ethernet cable", right?
-
From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?
Relatively impossible to estimate. Usually, vulnerability scanners don't check whether your application runs or not. They simply send requests indefinitely, until they have a hit.
Anyhow, updating stopped apps isn't technically feasible.
-
-
It just doesn't stop.. https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
-
-
@bazinga not exclusively. The same principle applies to pretty much any application outside Cloudron too. Sometimes, updates need to trigger hooks or migrations that require the application to be up. That's the main reason why.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login