⚠️ PHP CVEs. Update required!
## Upgrade now! Please upgrade to AIO v14.4.1 as soon as possible as it ships the updated php dependencies. See https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1 --- ## Initial report We have been informed by CERT of an issue affecting PHP, see their public statement at https://cert.europa.eu/publications/security-advisories/2026-018 and the PHP statement at https://www.php.net/archive/2026.php#2026-10-20-1 This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data. The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied. We will release an update as soon as more information is known about affected PHP versions and availability of updates. --- ### Temporary Mitigation for AIO deployments Best to shut down the whole stack by running `sudo docker exec -it --env STOP_CONTAINERS=1 nextcloud-aio-mastercontainer /daily-backup.sh; sudo docker stop nextcloud-aio-mastercontainer` until the update is available.
Posted by szaimen on Oct 21, 2026, 9:31 AM
Tags
Related issues
- I think RTS could continue to work if someone made a massive leap of faith and put all the modern infra around it that a AAA extraction s...
- RFC: Pluggable SessionDB Provider — PostgreSQL, MySQL, and Beyond
- v2.1.113+ broken on Termux/Android: native binary requires glibc, no JS fallback
- I’m firmly anti-Tahoe and haven’t updated, and I’ve started to find Apple despicable.
- [FEATURE] Link a source control repo as the source for organization skills
- Feature Request: Option to disable paste text collapse in input field
Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments
reliability (Sysadmin)
⚠️ PHP CVEs. Update required!
I think RTS could continue to work if someone made a massive leap of faith and put all the modern infra around it that a AAA extraction s...
RFC: Pluggable SessionDB Provider — PostgreSQL, MySQL, and Beyond
v2.1.113+ broken on Termux/Android: native binary requires glibc, no JS fallback
I’m firmly anti-Tahoe and haven’t updated, and I’ve started to find Apple despicable.
[FEATURE] Link a source control repo as the source for organization skills
Feature Request: Option to disable paste text collapse in input field
We went down the WASM sandboxing rabbit hole at Gobii when building our agent infra.
⚠️ PHP CVEs. Update required!
## Upgrade now! Please upgrade to AIO v14.4.1 as soon as possible as it ships the updated php dependencies. See https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1 --- ## Initial report We have been informed by CERT of an issue affecting PHP, see their public statement at https://cert.europa.eu/publications/security-advisories/2026-018 and the PHP statement at https://www.php.net/archive/2026.php#2026-10-20-1 This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data. The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied. We will release an update as soon as more information is known about affected PHP versions and availability of updates. --- ### Temporary Mitigation for AIO deployments Best to shut down the whole stack by running `sudo docker exec -it --env STOP_CONTAINERS=1 nextcloud-aio-mastercontainer /daily-backup.sh; sudo docker stop nextcloud-aio-mastercontainer` until the update is available.
Comments (0)
No comments yet. Start the discussion.