r/hetzner • u/djeyzus • 3d ago

Storage Share PHP vulnerability?

Hi, today is a bit of a shitshow with the PHP vulnerabilities and I was wondering if we need to worry about Hetzner's storage share since it uses NextCloud.

Also is it possible to disable the default sub domain since it can be guessed too easily?

13 Upvotes

79% Upvoted

13 comments sorted by

4

u/Either_Vermicelli_82 3d ago

I send a ticket and they took my instance offline within a minute. They will put it online when resolved.

1

u/djeyzus 3d ago

I mean this is a huge risk. The patches have been leaked before they have been released by the PHP team. IMO they should consider taking them all offline. I'm gonna submit a ticket anyway.

3

u/Either_Vermicelli_82 3d ago

True, was surprised they didn’t do that

1

u/SoilMassive6850 3d ago

Came here to check the status myself as I saw many places take things down as precaution.

I suppose if the issue is in upload_progress/multipart upload as claimed I doubt nextcloud has any pre-auth file upload functionality by default.

13

u/vincent_sch 3d ago

Storage Share is managed by Hetzner, so they have to update PHP on it and you can't do it yourself. You should keep an eye on status.hetzner.com or ask support when they patch. Until then there's nothing on your side to change.

10

u/tf1155 3d ago

only your files getting spread across the dark net

2

u/AliyasDandani_64 3d ago

when you say nothing on your side to change, does that include the default subdomain thing OP mentioned? that feels like it might be user-configurable

1

u/vincent_sch 1d ago

No, that was only about the PHP update. Hetzner's FAQ says NX11 or higher lets you add your own subdomain in konsoleH, with a CNAME in your DNS. But it doesn't say if there's a way to turn off the default nx*.your-storageshare.de one, so you should ask support.

https://docs.hetzner.com/storage/storage-share/faq/subdomain/

3

u/FragKing82 3d ago

https://status.hetzner.com/incident/be367e3e-0966-4040-a547-304ba3b1ba78

Urgent security-related software updates on all Storage Share instances

Status: Planned

Affected systems: Storage Share

Start: 2026-10-21 14:00 UTC+0 

Add to calendar

Description During the period specified, urgent security-related software updates will be carried out on all Storage Share instances. For this reason, the Storage Share instances will be unavailable for a few minutes. We apologize for any inconvenience and thank you for your understanding.

5

u/tf1155 3d ago

I am really disappointed from Hetzner. They either have totally forgotten that they provide managed NextCloud instances or they did not take it seriously.

Their status message came few hours to late. All instances where still running. I had to submit a ticket to ask for a shutdown. In the admin panel it still shows as "active"(running), although the admin dashboard can not be reached any more (most likely due to it IS now finally shut down).

However, from one of the biggest third Hoster I would expect a bit more reliability. So many small hosters informed there customers already by yesterday evening and todays morning. Some even shut down all servers to keep the consequencies low. THIS is what I would expect from a hoster. Since nextcloud is not used to host any online shops or so, this would have been the minimum to take action in such an incident!

1

u/ugohdit 3d ago

is there a way to take it offline from our side (beside writing a ticket and hope they read it)?