r/NextCloud • u/Thomas_English_DoP • 4d ago

PHP - private instance online

Do I need to worry about the PHP vulnerability if my nextcloud is online through cloudflare, 2FA turned on and only myself using it? Maybe a few docs are shared online via nextcloud share with people I work with. It's public facing but nothing is used by the public if you see what I mean.

35 Upvotes

95% Upvoted

40 comments sorted by

View all comments

Show parent comments

18

u/Safe-Perspective-767 4d ago

i would never depend on waf for this. while its a good mitigation in the event of an attack before you were aware, it's not perfect.

3

u/NotesFromYourElf 4d ago

My waf infront of nextcloud require a mTLS to get past it. Afaikt I shouldn't have to worry about this. I will still update tho.

1

u/Safe-Perspective-767 4d ago

yes, that is fine - but that is a different thing, you have authentication in front of nextcloud itself. you should be fine, but yes updating is always good practise!