Security issue thread - PHP and eMudhra cert compromise

[andreasdueren]

@marcusquinn Outrageous that I don’t have a Giga Fan badge.

[leighmhart]

@karlemilnikka Castopod has been updated, FYI.

[DidierMalenfant]

In the original post:

This should say 20260816ubuntu0.26.04.1 atleast. The first part is the date, and it must be **later** than that.

should probably say 'equal or later than that'.

[whitespace]

@girish The newsletter reads as if all packages have been updated. At least Wallabag is not as far as I can tell. Am I reading it wrong?

[james]

Hello @whitespace

There are currently issues with the @wallabag PHP update we are currently working on to resolve.
When this is done, the update will be available.

[joseph]

@whitespace https://github.com/wallabag/wallabag/pull/9099 (tldr upstream code hasn't been updated for a while and they have to make an upstream release first)

[whitespace]

@joseph Thanks, I am aware. I just wanted to point out that the newsletter statement 1. can be understood otherwise.

[james]

Hello @whitespace
I managed to resolve the issue and the update is released https://forum.cloudron.io/topic/3936/wallabag-package-updates/39

[whitespace]

@james So much appreciation! I love this community.

[odie]

Just want to add to the appreciation here. Very well done, guys, thank you very much!

[dsp76]

One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?

[DidierMalenfant]

@odie said:

Just want to add to the appreciation here. Very well done, guys, thank you very much!

Same here. Thank you so much for all the hard work!

[IniBudi]

For critical update, should we create a feature to immediately update apps like within or less than 5-minutes after the patch is released?

[jdaviescoates]

@dsp76 said:

One thing that may be a little improvement for the future: a state where I can update a package, which is not active. So before finally activating a package - it can be updated. What do you think about this?

Yes, I wondered about this too.

At present stopped apps cannot be updated. I'm not entirely clear why that is?

It would be nice to be able to update stopped apps without having to first start them, especially in situations like this.

[maxkreg]

I can see cloudron 10.1.6 being available now, but it is marked as unstable. Is it recommended to update manually, anyway? As far as I know, cloudron will not automatically update to unstable releases. Thanks!

[Lanhild]

@jdaviescoates a stopped application can't be updated because of potential migration scripts, runtime updates, etc.

[luckow]

@jdaviescoates Last week, I learned about two options:

1. Apps that run protected by a VPN
2. Apps that run in recovery mode

Both options work. Option 2 is the right approach if a security vulnerability works on ports other than 80 and 443.

[humpty]

+1 for having apps update while they're stopped. I have a few WP dev sites that I turn on for testing only and it's a PITA having to manually update them. From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?

[jdaviescoates]

@humpty said:

+1 for having apps update while they're stopped.

Sounds like there are technical reasons why that's not possible.

[Lanhild]

@humpty said:

From a security standpoint, what are the chances that an app will get compromised in the seconds it takes between the app start and triggering a manual update?

Relatively impossible to estimate. Usually, vulnerability scanners don't check whether your application runs or not. They simply send requests indefinitely, until they have a hit.

Anyhow, updating stopped apps isn't technically feasible.