I also maintain a language filter over at selfh.st/apps that can be used to identify PHP-heavy platforms:
Very helpful!
One I know about that's not on your list and is very likely to be an exposed service is Mailcow. Looks like the PHP filter isn't triggering for it, but it's definitely PHP based.
Good call-out. The directory pulls the prominent language from each project's repo, which is JavaScript for Mailcow.
I should update the dataset to grab any languages above a certain % threshold (25%?) to prevent instances like this where something might fall through the cracks.
That list isn't completely accurate for what you're after. My project, for instance, is not on the PHP list despite it being written in PHP because the platform is Docker. The selfh.st filter as described by eshol might be the better way to go.
The list is just for a quick check, I actually went through all the repos of my services
My Nextcloud is the only public facing service on the list. Is it sufficient to just disable public access via Nginx Proxy Manager and continue to permit local access for Nextcloud, or do I need to just shut down Nextcloud until it gets updated?
Public access is what is in immediate danger. Private services are safe from bots, but at risk from attacker on your network - a compromised IoT device or package on server could move laterally to vulnerable PHP services
Nextcloud is updated, go ahead and update yours.
None of my stuff is publicly accessible so yay for not having to take anything offline.
There are quite a few things offline in NL because of this though.
Roundcube and Baikal for me. I used Mutt for email today 😂
Browsing through the list... ok how do I tell if my server has been compromised, because I run a fuckload of those...
Synology includes some php runtime or package they require... I think... But I dont expose my services outside.
Phew, nextcloud and freshrss both have updates to resolve the vulnerability. Furiously logs in to update
The good thing about it is that all PHP applications run through a single service (unless you use containers for each of them individually, I guess), so it's really easy to take them all down at the same time, and update them all at once.
Isn’t zabbix missing ? Just from the top of my mind
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!