IssueRaiser

Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments

Sysadmin

⚠️ PHP CVEs. Update required!

szaimenOct 21, 2026, 9:31 AM

## Upgrade now! Please upgrade to AIO v14.4.1 as soon as possible as it ships the updated php dependencies. See https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1 --- ## Initial report We have been informed by CERT of an issue affecting PHP, see their public statement at https://cert.europa.eu/publications/security-advisories/2026-018 and the PHP statement at https://www.php.net/archive/2026.php#2026-10-20-1 This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data. The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied. We will release an update as soon as more information is known about affected PHP versions and availability of updates. --- ### Temporary Mitigation for AIO deployments Best to shut down the whole stack by running `sudo docker exec -it --env STOP_CONTAINERS=1 nextcloud-aio-mastercontainer /daily-backup.sh; sudo docker stop nextcloud-aio-mastercontainer` until the update is available.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue