Posts tagged: security

PHP2Shell: finding and patching every PHP runtime in the homelab

2026-10-25T06:58:00Z

PHP dropped a critical security release on Oct 21. Two unauthenticated RCEs (CVE-2026-109618 and CVE-2026-109619, collected under “PHP2Shell”, both CVSS 9.2) in the parts of PHP every request touches, memory management and error handling. Patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Worst case is Apache mod_php, where an exploit ran before any application code. PHP-FPM is affected too.

I knew nextcloud was PHP. Everything else was a guess, so the first job was an inventory.

The sweep #

Loop over every running container on both docker hosts:

for c in $(docker ps --format "{{.Names}}"); do
  docker exec $c php -v 2>/dev/null | head -1
done

Four PHP services, all on ghost:

service	php	sapi
nextcloud	8.3.35	apache mod_php
freshrss	8.4.26	apache mod_php
kanboard	8.4.24	nginx + php-fpm
wallos	8.2.28	php-fpm

All four sit behind traefik on *.paynepride.com, which publicly resolves to my WAN IP, and none had an IP whitelist. Internet-facing mod_php on a CVSS 9.2 is about as bad as my setup can get. Aurora had zero PHP, and pihole3 runs Pi-hole v6 which dropped PHP entirely. A half-finished k3s/argocd migration scaffold in the repo also turned out to be dead config, not a live cluster.

The fix, in order #

Pull what upstream already rebuilt. docker-library re-tagged nextcloud:32.0.15 with PHP 8.3.36 within hours of disclosure, and wallos:latest rebuilt too. Pull, recreate, done. Comparing the remote digest against the local one told me which images had new builds before I pulled anything.
Quarantine what couldn’t be patched. FreshRSS and Kanboard had no rebuilt tags, so I attached the existing default-whitelist@file middleware (an ipAllowList for LAN + tailscale) to their routers. Instant 403 at the proxy for anything off-LAN, verified live in traefik’s API rather than trusting the labels.
Patch locally instead of waiting on vendors. Distro security feeds moved faster than the app vendors. Alpine 3.24 already shipped php84 8.4.27, and Debian trixie-security had php8.4 8.4.27-1. Each stack got a three-line Dockerfile layered on the pinned tag: apk upgrade for kanboard, apt upgrade 'php8.4*' libapache2-mod-php8.4 for freshrss. Built on ghost, redeployed, verified php -v reports 8.4.27.

All four services now run patched PHP. The whitelist stays on freshrss and kanboard anyway, since LAN-only is the right posture for them regardless.

Lessons #

Official base images get silently re-tagged; app images don’t. nextcloud:32.0.15 quietly moved to a patched build while freshrss:1.30.1 never will. Digest comparison beats guessing.
The distro fixes the language, not the vendor. When the app image lags, its base distro’s security repo usually already has the patched PHP package. A patch layer on the pinned tag is the move.
A reusable whitelist middleware doubles as an emergency quarantine. One traefik label took a service off the internet without touching the app.
“What runs PHP” was a 30-second exec loop. Faster than auditing compose files by hand, and it caught wallos, which I’d forgotten was PHP at all.

Co-authored with Devin, who ran the container sweeps, compared image digests, applied the whitelist middleware, and built and deployed both patch images.

💭 microsandbox/microsandbox: Self-Hosted Plaform for Secure Exec…

2025-06-19T10:46:03Z

Here’s my thought on microsandbox/microsandbox: Self-Hosted Plaform for Secure Execution of Untrusted User/AI Code

There’s a ton of AI related tools I want to play with, and there are several I run in docker pretty willy nilly. However, the MCP server stuff as of late has felt fast and borderline reckless so I like seeing a project seeking to make it easy to sandbox code… I get blocked by this idea cause I’ll want to setup a VM on a VLAN or something before just spinning up an mcp server idk if I should trust - but if I can do it with a library then that’s amazing!

We just have to hope the motivation to try this stays strong enough to get started

Note

This is one of [[ my-thoughts ]]. I picked this up from Waylon Walker(https://thoughts.waylonwalker.com). It’s a short note that I make about someone else’s content online. Learn more about the process Thoughts

💭 “We would be less confidential than Google” – Proton threatens…

2025-06-13T02:19:29Z

Here’s my thought on “We would be less confidential than Google” – Proton threatens to quit Switzerland over new surveillance law | TechRadar

I’ve been a proton user for several years now, and pay a decently hefty subscription fee for some of their services that I love having access to (multiple domains, email relay, simplelogin, etc.). This privacy impact in Switzerland is concerning and I am definitely biting my nails over the future of this platform

Note

💭 Exploiting Copilot AI for SharePoint | Pen Test Partners

2025-06-13T02:17:17Z

Here’s my thought on Exploiting Copilot AI for SharePoint | Pen Test Partners

In hindsight this vulnerability isn’t even that clever, hopefully the share holders of the companies that rushed to throw AI into everything will make it out ok

Note