Oh my, #PHP is in the German evening news!
It seems version 8.3.6-0ubuntu0.24.04.13 contains the back-ported fix of #PHP2Shell. Luckily, i only have to take care of my personal #Nextcloud instance.

Trying to #degoogle here. Got calendar exported ok, but am struggling to find how to import the exported #JSON task list into #nextcloud provided by #disroot.

Seems you have to try to convert the JSON task list to an .ics file, but my searches run out of road here, having more to say about converting for events rather than #tasks.

tl;dr:
Please help export google tasks into nextcloud tasks.
TYVM

Wegen #PHP2shell habe ich unsere #Nextcloud Instanzen erstmal offline genommen. Betreibe das hier mit den AIO Images.
Wie handhabt ihr das?
#selfhosting #homelab #php

Is it time to move away from #nextcloud given its still running #php ? Are there easy paths to transition to more modern self hosted platforms ?

Nextcloud AIO bug report about PHP CVEs:

https://github.com/nextcloud/all-in-one/issues/8876

#Nextcloud #PHP

If you're running #Nextcloud or any other PHP application, whether in containers or natively, update your PHP installations!

Especially if you're using Apache with mod_php, which is considered the highest-risk configuration for #PHP2Shell.

The #Debian Security Team has already released PHP 8.4.27-1~deb13u1 for #Trixie.

Happy host and container patching :)

#PHP #homelab #sysadmin #security

@bjoern
Armbian Pakete von https://packages.sury.org/php sind vorhanden - soeben installiert auf meinem Nextcloud SBC und php8.3-fpm neu gestartet.
@kuketzblog
#nextcloud #PHP #armbian #sury

wow, https://nextcloud.com itself is down. I guess the PHP issue ?

#php #nextcloud

and even though we have a presence on #mastodon we haven't bothered to post anything since August 2025.

Today would have been a good day to do so @thegoodcloud

#TheGoodCloud #nextcloud #php

Okay, offenbar wird die PHP2Shell-Lücke in PHP bereits ausgenutzt, zumindest gibt es Proofs of Concept dafür.

Trennt Eure PHP-Webseiten vom Netz, bis Euer PHP gefixt ist. Durch Euch selbst (VPS oder Dedicated Server) oder durch Euren Hoster (Web Hosting Pakete).

Das betrifft alle PHP-Seiten, z. B. Joomla, Nextcloud, Pixelfed, phpMyAdmin usw.

Mastodon nutzt kein PHP und ist darum nicht direkt gefährdet.

#PHP2Shell #Nextcloud #Pixelfed #Joomla #PHPMyAdmin

@stefano

Good lord. #nextcloud runs on PHP. Is there really no mitigation other than taking it down?

PHP2SHELL: this affects all of NextCloud?

#php2shell #nextcloud

Nextcloud Classic Menu

Wer das neue Waffel-Menü zu umständlich und zeitraubend findet, bekommt mit dem Classic-Menu das Beste aus beiden Welten.

#Nextcloud #Menü #Nextcloud_Apps #Linux

https://gnulinux.ch/nextcloud-classic-menu

🚨 A heads-up for anyone running #WordPress, #Moodle, #Nextcloud or other PHP-based services.

PHP has confirmed two critical vulnerabilities, both rated 9.2/10. Fixes are scheduled for today, 21 October, at 14:00 UTC.

Prepare to patch PHP, not just your applications. CERT-EU advises considering temporary isolation of public-facing services if prompt patching isn't possible.

It sounds pretty bad. Affected versions are not yet confirmed but I've heard 5.4+

https://www.php.net

#PHP #Security #SelfHosting

I picked the perfect time to delete #nextcloud off my home server two days ago. Maybe I should buy a lottery ticket 🤔

Wenn Ihr Websites auf Basis von PHP (Nextcloud, Joomla, Pixelfed, phpMyAdmin...) betreibt, sollte Ihr wissen, dass zwei schwerwiegende Sicherheitsprobleme in PHP ab Version 5 gefunden wurden.

Abgesicherte Versionen werden heute ab 16 Uhr MESZ veröffentlicht, die solltet Ihr dann so schnell wie möglich einspielen. Oder Eure PHP-Webseiten vom Netz trennen.

https://stadt-bremerhaven.de/php-kritische-sicherheitsluecken-ermoeglichen-code-ausfuehrung-aus-der-ferne/

#PHP #Joomla #Nextcloud #PHPMyAdmin #Pixelfed

Don't forget that #Nextcloud runs on PHP so for those of you who tend to set it and forget it, keep an eye out for those PHP patches tomorrow.

Am nächsten #DiDay in #oldenburg geht es um das Thema #nextcloud.

Kommt vorbei, um euch von Big Tech zu befreien.

Am 1.11.26 ab 18 Uhr im Mainframe, nahe dem Bahnhof.

Alt...

Flyer für DiDay Oldenburg

Interesting, there seems to be developing new #keepass compatible version for password management in #nextcloud, Highly welcomed,

https://github.com/StudioCuda/KeePassNC

If anyone is at the @Nextcloud Enterprise Day in Copenhagen today, come say hi! 👋

#nextcloud #nextcloudconf2026 #opensource #openproject #conference

Alt...

A big banner saying Nextcloud Enterprise Day Copenhagen 2026

Alt...

A selfie with my badge

Man kann mit KI schon geile Sachen machen. Seit heute morgen steht in meinem Keller ein kleiner Rechner. 100€ refurbed. Darauf ein #Linux, #Obsidian und #Nextcloud-Sync. Sowie eine kleine Applikation, die die Texte in beiden Systemen per #ollama und #embeddinggemma in #Vektoren übersetzt. Per #LongPolling horcht eine kleine Applikation auf einen Nextcloud #Talk Chat, und beantwortet Fragen. Für letzteres ist dann doch noch ein billiges externes #LLM über #Mammouth eingebunden.

Alt...

Ein Screenshot von Nextcloud Talk. Michael Giesler fragt: "@Obsidian, wie heißt mein Homeserver?" Obsidian antwortet: "Dein Homeserver ist im Netzwerk als "kellerrechner" bekannt. Quelle: Ressourcen/Homeserver.md"

y'know what would be a marriage made in heaven? Or close to it?

#Nextcloud on #OpenBSD.

With #EuroOffice, #ZFS, #NextcloudTalk, #encryption, #federation, #2FA, and the kitchen sink of options in Nextcloud's apps and services… #FLOSS platforms developed in the #EU and #Canada and the rest of the world.

Fully able to displace US-based #BigTech / #BusinessBigTech straight out of the box, and running on pipes direct to #Europe with #Norway's help, and to #Asia w/ #CPTPP.

This could be good.

@womp #Seafile has never been a replacement for #Nextcloud. Seafile can replace the file sync. But there are many other features in Nextcloud, that Seafile was never intended to replace.
Using Owncloud/Nextcloud for more than a decade, initially on a Raspberry Pi. No problems like that you are talking about.

Musik in Nextcloud organisieren

Musik in Nextcloud organisieren ist manchmal eine Herausforderung. Aber es gibt Mittel und Wege das zu organisieren.

#Nextcloud #Musik_Streamer #Ampache #subsonic #Linux

https://gnulinux.ch/musik-in-nextcloud-organisieren

today is a joyous day, for I have yeeted #nextcloud into the virtual trash where it belongs. never again will it bog down my #homelab server or my client machines with its amateur-hour user interfaces and intern-grade PHP infinite loop code triggering all my cpu and thermal alarms at random hours.

for anyone wondering I finally replaced the file sharing with #seafile and it is better in every way

CVE-2026-110447: Critical Nextcloud Collabora CODE Server vulnerability

A command injection flaw in Nextcloud’s built-in `richdocumentscode` app can allow unauthenticated OS command execution when the embedded CODE server is not running.

The concerning part: public reports describe successful exploitation, PHP web shell deployment, and attempts to locate password databases and cryptocurrency wallet files.

Patch: `richdocumentscode` 26.4.303 or later. Disabling the app alone is not sufficient.

Technical analysis, detection commands, and remediation:
https://thecybersecguru.com/exploits/nextcloud-cve-2026-110447-collabora-rce/

#CyberSecurity #Nextcloud

🚨 Rapid Response | Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) (CVSS 9.2) is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation in the wild has been reported, allowing unauthenticated attackers to execute operating system commands.
Censys currently detects 19,454 Internet-exposed hosts and 103,350 web properties with the app installed. These figures represent detected installations, not confirmed vulnerable instances.

Organizations should upgrade to version 26.4.303 or later, or remove the app. Disabling it is not sufficient.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-110447/

#CensysARC #Cybersecurity #VulnerabilityManagement #Nextcloud #InfoSec

Alt...

Censys world map highlighting countries by host count from Censys. Notable figures include Germany with 6,965 hosts, France with 1,819, the United States with 1,607, and Russia with 1,382. A list on the side outlines the total hosts for other countries.

🤖 CVE-2026-110447: OS command injection in the Collabora Online "Built-in CODE Server" app (richdocumentscode) for Nextcloud. Exploited since mid-September to plant PHP webshells and hunt password stores and crypto wallets. Fix: update to 26.4.303+; disabling the app is not enough.
🔗 https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/
#CVE #Nextcloud #Exploit #CyberSec

🤖 CVE-2026-110447: critical command execution flaw in Collabora Online's built-in CODE Server app (richdocumentscode) for Nextcloud. Actively exploited to backdoor servers. Patch the app, audit for webshells.
🔗 https://www.bleepingcomputer.com/news/security/hackers-exploit-collaborarceflawtobackdoornextcloudservers/
#CVE #CyberSec #Nextcloud

So, sieht so aus, als würde ich das NextCloud-Problem nicht ohne Unterstützung vom Hoster beheben können. Nach dem Vesuch, erst mal NextCloud upzudaten versteift sich das Ding auf "Internal Server Error" und nicht mal das Zurückspielen des Backups hilft hier weiter. WTF!?

#NextCloud

Kann es wirklich sein, dass #ionos #nextcloud #ManagedService ihren Kunden überhaupt keinen Weg zu einem full #backup anbietet?

Support heute: Kein Export, kein Systemzugriff, nicht mal gegen Geld als Service.

Nada, nothing, nichts?

Ich bin platt .. und freue mich über jeden Tipp.

@kallekn @iode

Yes it is. I used a throwaway account to activate it. Now I only have a self-hosted #NextCloud account, connected via the #Davx5 app.