RE: https://mastodon.social/@NextCloudPi/117479146495088415
UPDATE: The patched #PHP versions are released.
To upgrade, either wait for the unattended upgrades to take effect (make sure they're enabled and your #Nextcloud is not reachable from the internet until the updates are complete) or run the following commands on your system:
apt-get update; apt-get upgrade
Afterwards make sure that either PHP 8.3.36 or PHP 8.5.12 is used by Nextcloud, by checking https://your-cloud.address/index.php/settings/admin/serverinfo.
Critical #vulnerability in #PHP
#Nextcloud, like all other PHP based services are currently affected by a vulnerability that allows attackers to execute arbitrary code on the server.
A patch is announced for today (that doesn't necessarily mean, that it is also available in the package sources, but that shouldn't take long).
#NextcloudPi will install it within 24h after being available if you have (system) auto updates enabled.
It is advised to SHUT DOWN your Nextcloud instance ...
1/2
@NextCloudPi@mastodon.social for the type of bug that it is, I would at least recommend these actions in the reverse order.