Thank You for Patching: Homelab

Nextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten days

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. CVE-2026-110447 is unauthenticated command injection in the optional “Collabora Online - Built-in CODE Server” Nextcloud app (richdocumentscode). Admins reported attacks going back to Sept 10, and CISA added it to KEV on Oct 23.

Fixed in: richdocumentscode 26.4.303, released Sept 11. The advisory and CVE didn’t appear until Oct 14, so if your scanner stayed quiet in September, that’s why.

How it works: A request to the app’s proxy.php injects OS commands, but only while the bundled CODE server is stopped. Attackers have been dropping PHP web shells and hunting for password databases, password-manager files and crypto wallets.

Who’s hit: Self-hosted Nextcloud with the built-in CODE app. Collabora says standalone Collabora Online, Docker and RPM/DEB installs, and Nextcloud All-in-One aren’t affected.

Do: Update to 26.4.303 or later, or remove the app. Disabling it isn’t enough. Then look in apps/richdocumentscode for PHP files you didn’t put there, and check proxy.php requests back to Sept 10. On Nextcloud 29 or older, upgrade Nextcloud or remove the app.

Sources: BleepingComputer, GitHub advisory, The Hacker News.

php2shell: patch PHP now, and remember how many of your boxes quietly run it

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. CVE-2026-109618 and CVE-2026-109619 together give an unauthenticated attacker remote code execution on any PHP install that serves web requests. Fixed builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix, and CISA says to take those systems offline until you’ve patched.

Exploitation: CISA’s alert, revised Oct 23, says successful exploitation had not been observed at publication. Unit 42 has seen a proof of concept. One post on X claims it’s already being exploited. I haven’t seen that corroborated.

Where PHP hides:

PAN-OS/Panorama management UI, all releases from 10.2 to 12.2. There’s no fixed build yet. Hotfixes are due Oct 26-30. Until they land, restrict management access to a jump host and remove management profiles from untrusted interfaces. GlobalProtect is not affected. (ctipilot write-up of the PAN advisory)
pfSense. Update from SSH or the console, not the GUI, and force-reinstall WireGuard or it may not come back up. Don’t do it over the WireGuard tunnel you’re connected through. (Netgate)
Synology. Update PHP in Package Center. MailStation needs a manual update. (Synology)
TrueNAS. The platform isn’t affected, but PHP-based catalog apps are, so update those images. (TrueNAS)

Sources: CISA, PHP Foundation, CERT/CC VU#763488.

Plex2Shell: your media server is now somebody else's crypto miner

Sat, 24 Oct 2026 00:00:00 GMT

Call: Patch now. Four Plex Media Server bugs (CVE-2026-96652, -96654, -96655, -96656) chain into unauthenticated code execution. Plex confirmed active, widespread exploitation on Oct 19, three days after a public proof of concept, and CISA added all four to KEV on Oct 20.

Fixed in: 1.43.3.10861. That build went public on Aug 4, so this is less a new patch than a bill coming due. If you’re on it, you’re fine. If your NAS package center says you’re current, check anyway: Settings > General in Plex Web shows the real version.

What attackers do: Steal the owner’s admin token, write a shared library into the Codecs folder, run it. Payloads seen so far are crypto miners and proxy software that rents out your home connection.

Who’s hit: Anyone with Remote Access on or port 32400 forwarded. Field Effect cites Shadowserver counting more than 36,000 exposed, unpatched servers in early September. Internal-only servers are still reachable from your own network.

If you were exposed while vulnerable, assume compromise. Plex’s IoCs: unfamiliar child processes (myawesomeproxy, mylovelyminer, x12345), unknown .so/.dll files in Codecs, transcoder options in Preferences.xml you didn’t set, traffic to proxystream.st, high CPU while nothing plays. Rebuild from a clean install, sign out all devices, change your Plex password, and treat any share the Plex account could reach as exposed. Then turn off Remote Access if you don’t actually stream away from home.

Sources: Plex advisory, CISA, Field Effect.

Debian 13 kernel 6.12.111 and Broadcom NICs: Proxmox already did this one

Sat, 24 Oct 2026 00:00:00 GMT

Call: Hold on Debian 13 hosts with Broadcom NetXtreme-E (bnxt_en) NICs. This is reported, not confirmed: there are two merged Debian bugs, #1149564 and #1149790, and one of the reporters runs a fleet of identical servers. Stay on 6.12.107+deb13, which the reporter confirms is stable.

Symptoms: AMD-Vi IO_PAGE_FAULT from bnxt_en, “Abandoning msg … firmware status: 0x2000001”, and hwrm errors. One port dies, and later the other. It happens idle or under load. Firmware updates didn’t help.

Why it looks familiar: Proxmox kernel 7.0.14-20/-21 hit the same bnxt_en DMA padding regression in September. Proxmox fixed it in -22 and -23 with the upstream patch “bnxt_en: fix DMA mapping length for padded small packets.” If you run PVE, move to 7.0.14-23 or later and drop your kernel pins. If you run plain Debian, wait for a kernel that carries that patch.

Sources: debian-kernel list, Debian #1149564, Proxmox pve-devel.