A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
"I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced."
Seriously though, how quickly do you expect patches to be available for WordPress? I've got one WordPress site that I made years ago for a friend's business. I pop in on it and update stuff every few months.
Should I take it down?
it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.
edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.
Yeah it's self hosted, thanks
Should I take it down?
depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don't take proper backups)?
How dare you (correctly) assume I haven't taken proper backups!
Jk lol
I do have a couple backups I made a few months ago. Never tested restoring them, so I don't count them as "real".
I'm hosting on namecheap servers, using their cpanel and stuff. So I don't have the option of installing my own PHP version, just selecting theirs.
But apparently they had some mitigations in place before updating, and then they got us updated.
it's a lot more than wordpress...
Nextcloud.
Mailcow.
Spare a moment's thought for the dev behind the ondrej PHP mirrors.
Could not pull shit from it this morning. I panicked because my distro's repos did not have the version numbers of the patched packages, but apparently the Ubuntu maintainers back ported the patches. Sigh of relief.
I just happened to read this thread after deciding to open Jerboa after months and I stumbled into this, I have been updating my stuff for the past 30', thank you for making this post and making me aware of this issue! (Even though I'm 8 hours late)
Why do it this way? I'm genuinely unaware.
With the plex2shell, they fixed it in a previous update, then told us later.
If PHP knows what the problem is, why announce it now, and then release the patch. Why not release the patch, say hey guys this is an important one, and then tell the world/every script kiddie who didn't know about php2shell AFTER everyone is patched?
Like I get it, I guess, php2shell must already be happening, the vulnerability is already there, but like... Shut up about it? Right? Let more people patch before you announce why the patch exists?
I'm new to this world so maybe this is normal?
They didn't move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.
We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.
Wow, this article really reads as LLM-generated to me. The quoted section with the "We won't pretend otherwise:", the second paragraph in:
This post isn't about how to update. It's about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP's security work going.
Could they not be bothered to write a write-up about such a critical severity?
They originally tried to keep it secret but it got leaked. Initial reports were only that CVSS was 9.2 and it was a permissionless remote code execution exploit. After it got leaked what the exploit was, they gave up.
Plex is a closed source software, so it's easier to just push an update and tell about this later. PHP is open source, so if they release a patch for it, you can immediately look up in the source code and find out what has been fixed and kind of reverse engineer what the problem could be.
As this is a very high-class vulnerability, I assume that it's very easy to get into this so if you see the patch, it's probably trivial to just find out what the issue is and immediately start attacking everyone. With this, at least most admins are ready and can plan in that on this time they should check into the issue and patch asap.
Ah that makes more sense, that's the key I was missing, thank you
Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.
It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.
My guess is releasing these CVEs the normal way could have catastrophic consequences. They're giving stsadmins a heads up so there is less of a scramble when sysadmins read "hey fix your shit it's totally vulnerable" before they have their coffee.
Like as a sysadmin, this is a great way for them to do this.
I will in 10 mins alert my team that the whole site has to come offline for a period today. I don't need to take it offline in an emergency and tell my boss to send out a memo.
I wonder how many docker containers keep their own version of PHP...
I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.
The manual fix is relatively easy, just change a few configs.
Services are only exposed on local WiFi and behind Tailscale, updated all as soon as possible: still quite safe right?
Yeah, as long as your firewall is properly hardened and up to date.
And not using php for a webui
Shouldn't especially vital services be taken down to secure them?
Yep. Except if taking them down will kill people.
takes down 112 / 911 services
Don't worry guys, we're safe now! ꒰ঌ(˶ˆᗜˆ˵)໒꒱
Me when I take down only one hundred twelve out of nine hundred eleven services, leaving seven hundred ninety-nine services still running
Safe here, we use 999
round these parts we use 0118 999 881 999 119 725 3
I'll never remember that. I'll just send an email...
0118 999 881 999 119 725 3
We're YOUR emergency services
As if those are running anything as recent as php.
For their interactive mapview in the control room they probably do.
It's just one thing after another. I already had to make sure every computer and VPS has the updated CA certificates earlier today. Now I just finished disabling all of my web servers. I hope Debian doesn't take forever getting the patch out.
They took just a few hours to squeeze out a new ca-certificates. On the other hand the last time there was a huge kernel bug it took well over 24 hours I think…
A bad ca is update a file on every pc and application. A kernal bug is way more involved so it doesn't make a new problem later.
They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
Think of Louisiana before Katrina. Those systems of pumps and dykes are expensive and had been neglected... which was fine right up until they were severely tested by Katrina.
Our orange city counselman stopped funding repairs and inspections on the dykes and pumps many years ago (when he destroyed CISA). They've been deteriorating from neglect ever since.
A large hurricane is going to hit at 14:00 UTC
(In 10 minutes)
It'll almost certainly be handled quietly and nobody will know but system admins, but this could be a bigger thing than usual.
laughs in keeping an old archive site still in PHP5
The vulnerabilities go back that far. You're not safe.
Hey, never said I was laughing out of happiness... 😭
Patches are showing up in the repos now. Ondrej and ubuntu 24.04 have them live now.
Synology had a critical system and PHP package update yesterday, could it be related 🤔
No, there is no fix released for this PHP vulnerability
Wouldn't be surprised if the big guys got first dibs before everyone else
@Guiorgy @shadowtofu That's not how embargoes work. If "the big guys" release, everybody releases. There have clearly been leaks, but afaik no patches made public yet.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| CA | (SSL) Certificate Authority |
| Plex | Brand of media server package |
| VPS | Virtual Private Server (opposed to shared hosting) |
3 acronyms in this thread; the most compressed thread commented on today has 19 acronyms.
[Thread #142 for this comm, first seen 21st Oct 2026, 12:40] [FAQ] [Full list] [Contact] [Source code]