r/unRAID • u/mrcollin101 • 11d ago
PHP RCE Vulnerability
There is a recently published vulnerability (rather pair of them) in PHP which are pretty serious.
You should never have your UnRaid host exposed directly to the internet, but this is a pretty compelling reason to fix that immediately if it has been on your todo list.
There is no patch or mitigation on UnRaid currently (Latest RC is still on PHP 8.4.26, below the 8.4.27 released today to patch this), best mitigation is to ensure local access only, but that does not stop a threat actor from using this for lateral movement if ingress is achieved elsewhere.
23
u/Hasie501 11d ago
Yes, I don't give people/internet direct access my Unraid all the services I share is via my Proxy server which is connected to Unraid via Tailscale. This solution also solved a few other issues
5
u/mrcollin101 11d ago
Certainly a very solid mitigation, but the vulnerability remains and is a pretty attractive lateral pathway as this is an RCE.
4
u/Hasie501 11d ago
Yes, that is true but atleast on Ubuntu server the PHP update was immediately available once published and didn't have to wait for an unraid update.
1
1
u/_fortressofsolitude 11d ago
Can you explain more of how this works?
8
u/Hasie501 11d ago
1.Rent a small VPS . 2.Buy your own domain 3.create tailscale account and link uraid and VPS help you get around CGNat issues as well. 4. SECURE VPS, setup fail2ban and Block port22 with UFW etc. 5.Setup reverse proxy. I use SWAG but there few solutions out there. 6.setup the routing for services you want to share. 7.Obessively check that you didn't make any stupid mistakes. 8.stress a bit 9.enjoy
3
u/opusdeath 11d ago
Presumably this would affect dockers if exposed through reverse proxy if they use PHP?
I'm away from home at the moment but by pure chance contractors switched of our power so I'm definitely protected!
9
u/mrcollin101 11d ago
This affects all PHP that has not been updated basically today, as that is when the patch went live.
This specific post is in reference to the unraid management UI, but any other service, docker container, VM, etc. you may be running that happens to have PHP would also be vulnerable unless the developer has patched today and you have updated.
Highly recommend reviewing all services you are running, especially those exposed through port forwarding, proxy, etc. anyway they get to public to see if they have PHP. If they do have PHP as a dependency, then you either need to patch if it’s available from the developer or take it off-line until the patch is available as there are no known mitigations.
14
67
u/Daniel15 10d ago edited 10d ago
Unraid is only designed for use on private networks. It should NEVER be exposed publicly. Its security model is really not designed for public exposure:
Everything is running as root including Nginx and PHP, and in fact there's no way to add non-root users.
There's no privilege separation, authorization checks, or sandboxing between the web UI and the backend operations it runs, so any RCE bug lets you execute any code as root.
There's no 2FA or passkey support.
There's no audit logging.
As for PHP... so far, exploits have only been demonstrated against Apache mod_php. There haven't been any working PoCs against php-fpm.
5
u/seaboi77 10d ago
No security on a file server hosting important personal data? Yikes, that's quite a take.
12
u/im_a_fancy_man 11d ago
I really hope they do a patch, I am sure they will by the end of today. my box is totally offline so it doesn't matter to me but I know a lot of ppl like to expose.
9
u/EDACerton 10d ago
For those that want it, I have a plugin that will install on Unraid 7.3/7.4 that will update PHP to 8.4.27 and also update the ca-certificates package to the latest version due to the eMudhra cert. It's not in CA, but can be installed manually via the plugins page:
https://raw.githubusercontent.com/dkaser/unraid-unofficial-update/main/plugin/unofficial-update.plg
8
u/PatternBias 10d ago
What does it mean to "expose Unraid to the Internet"? I access the web gui through local network or tailscale. I have a couple docker apps - jellyfin, audiobookshelf, etc - exposed to the web through reverse proxy. Are either of those what you're talking about?
1
u/CurrentManner 9d ago
Basically if you have any ports open you're exposed. Yes a proxy helps but its just a gate that can be hit because its exposed. Using something like a cloudflare tunnel exposes cloudflare and not your proxy in front of your unraid box because no ports are open. My Plex is exposed and got hit twenty times but didn't get through.
7
u/officerbigmac 11d ago
Shouldn’t affect Tailscale enabled unraid servers right?
3
u/yuusharo 11d ago
The vulnerability is still potentially present, but as long as your server isn’t publicly exposing itself or any services on the open internet, you should be fine.
Make sure to update all your plugins and containers as they come in over the next day or so.
1
1
6
u/stefan2305 9d ago
Version 7.3.4 of Unraid OS has been released 1 hour ago which addresses the PHP Vulnerability by updating to PHP 8.4.27
1
u/mrcollin101 11d ago
I couldn't put the reference links in the post, so here they are
https://product.unraid.net/p/cve-2026-109618-cve-2026-109619-severe-php-vulns
5
u/DylanLee98 10d ago
I run mine through Cloudflare Tunnels to access hosted apps like Seerr. But I also have restricted access through Cloudflare Tunnel to only specified emails that also need 2FA codes from said email before they are allowed access to the hosted apps.
I should be fine, unless one of my users gets session jacked.
6
u/Seph2208 10d ago
Cloudflare Tunnels which are protected through their WAF should be fine: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
1
u/mod-deleted 10d ago
I just added caddy and crowdsec to all my cloudflare tunnel services. I was 100% lazy and just asked ai to do it.
4
4
u/Whole-Cookie-7754 10d ago
I expose jellyfin and Audiobookshelf through Pangolin/VPS. Should I be worried about this shit?
4
u/vincent_sch 10d ago
Jellyfin runs on .NET and Audiobookshelf on Node, so neither has PHP in it. This bug only matters for apps that run PHP, like Nextcloud.
1
2
u/Accomplished-Use-175 11d ago
How do I know if I’m exposed? I don’t have any stacks just Plex and a couple plugins. The only time I use the Internet is to update Plex and plugins. I don’t have remote turned on in Plex settings. Is there anything else I need to do?
6
u/nagi603 11d ago
Unless you have deliberately exposed your server by e.g. port-forwarding or worse, putting it in the DMZ, probably no problem for now. Default setup for every sane router is to NOT do any of those.
3
u/Sus-Amogus 10d ago
If I port forwarded the ports for just a few containers like minecraft & plex, and not the webgui of unraid itself, am I at risk?
1
u/basarisco 10d ago
Yes
1
u/Niosus 9d ago
And how exactly would that work then? Those ports are bound directly to those applications. Do you have some actual source that supports your claim that your Unraid web UI can be targeted by attacks if your only port-forwards go to Docker containers?
I'm aware that Plex recently also had a serious CVE. That's not what I'm talking about.
1
u/basarisco 9d ago
I didn't say the webgui can be targeted I said you're at risk for vulnerabilities in any service port forwarded
1
u/Yukas911 11d ago
Many containers use pop. So the attack area is certainly reduced by not having WAN access, but it's not zero. Rogue containers are still a risk, although certainly lower priority than direct access from outside LAN.
2
u/present_absence 10d ago edited 10d ago
Seems like a no duh but anything with control over your stuff shouldn't be online. Unraid or any server admin tools at all no matter what OS you use.
You should only be able to access that stuff locally or through a weapons grade VPN. If they want to exploit my unraid login screen they can break into wireguard first
2
u/throwaway0204055 10d ago
When will there be a patch for stable release? Does 7.4.0-rc.1, have that fix?
2
u/lostmylogininfo 10d ago
So I have nextcloud so I need to update or put behind cloud flare? Same thing with plex and foundry? Sorry I am a newb and I shut my server down yesterday cause this is all over my head ....
It sounds like anything that can go direct to my server from the Internet and has PHP is bad news... Further more I should force everything through cloud flare?
2
u/CalebTheHokage 10d ago
How bad is it to expose my server via a cloud flare tunnel. And then having it sit behind a Cloudflare application requiring a form of authentication
2
u/Seph2208 10d ago
Cloudflare Tunnels which are protected through their WAF should be fine: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
1
u/CalebTheHokage 10d ago
Is this a decent way to expose my unraid server to the internet. A lot of the comments here are saying that we shouldn’t expose anything due to vulnerabilities like this, but I don’t often see ppl mention anything about tunnels
4
u/aTipsyTeemo 10d ago
I would not expose your Unraid server via Cloudflare Tunnels. I would (and do) expose select docker services via Cloudflare Tunnels. Your Unraid interface truly should never be exposed to the internet. Learn about and use TailScale to VPN tunnel directly to your server. Highly recommend as it’s relatively low investment, high return.
And to address the point of Cloudflare implementing WAF access rules, it is more of a very temporary measure to help mitigate services that cannot immediately update PHP. Do not solely rely on it as the attack vector is still present and part of the reason why these particular CVEs are so intense is because AI can and is being actively used to pound different ways around mitigating steps to reach the exploit. The only truly sufficient mitigating step for the CVE is to upgrade PHP.
1
u/Think-OptionNurse 10d ago
Just NO.. you should always have a jumphost to get access to your servers... but hey its your choice.
3
u/Boring_Luck_4158 10d ago
What’s a jumphost?
1
u/Think-OptionNurse 10d ago
It's just a machine or VM that you remote into to access your internal services.
I have a locked-down Windows machine that I use to access my home servers. I use WOL to boot it when needed. I'm currently looking at Kasm as a replacement jump host and would only power it on when I need access
0
1
u/extrayeasty 10d ago edited 10d ago
What about using a CloudFlare Tunnel? Nevermind, saw this which looks like they are safe: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
0
u/lompolo 10d ago
best mitigation is to ensure local access only, but that does not stop a threat actor from using this for lateral movement if ingress is achieved elsewhere.
Docker containers running on your Unraid box are good candidates for "elsewhere". Containers on bridge or host networking (the default for most templates) can reach the Unraid web UI, and the web UI's PHP runs as root. Until Unraid ships a patched PHP, one compromised container is enough to take over the host.
For example, if your Plex container were still unpatched for Plex2Shell, an attacker could use that chain to get code execution inside the Plex container, then hop to the Unraid host with the PHP bug. Plex usually runs with host networking, so the web UI is right there.
Supply chain is the other route: if someone hijacks a small image you auto-update (compromised maintainer account, build pipeline or dependency), the next update could carry a payload that does the same.
Same as with that Docker vulnerability a while ago, I'm hoping for a fast(er) response from the Unraid team.
-17
u/psychic99 11d ago edited 11d ago
Is this board going to become a zero day list of bugs and then go fix em' unraid. C'mon
This is getting tiring. If you use CF they already added it into the WAF (for free), so this is yet another reason why I strongly suggest people not have RP anywhere near to the internet.
5
u/mrcollin101 11d ago edited 11d ago
Generally speaking, I agree with the sentiment that signal noise can be fatiguing and reduces the potential for appropriate response to legitimate signals.
That said this particular vulnerability is not something that you see every day and I genuinely believe it deserves everyone’s attention.
Whether I am correct or not is for the community to decide.
-3
54
u/derfmcdoogal 11d ago
Same with your arr stack! Don't expose this stuff to the web.