Skip to content

Security: nixpkgs to 2026-10-21 (PHP 8.4.27 fixes PHP2Shell, CVE-2026-109618 and CVE-2026-109619) #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
morph-eos merged 2 commits into from
Oct 22, 2026
Merged

Security: nixpkgs to 2026-10-21 (PHP 8.4.27 fixes PHP2Shell, CVE-2026-109618 and CVE-2026-109619) #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5025de4
flake.lock: nixpkgs to 2026-10-21 (PHP 8.4.27 fixes CVE-2026-109618 a…
morph-eos Oct 22, 2026
e6d34bc
v0 replica: Nextcloud 33.0.10, as v0 now runs after the PHP2Shell patch
morph-eos Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/migration-from-v0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Moving v0's data to tidepool

Rehearsed in the lab on **2026-10-05** against a replica of v0 (`lab/v0-replica/`: the same services in Docker, seeded through their own APIs), without touching the real machine. The driver is [lab/v0-migration-u25.sh](../lab/v0-migration-u25.sh); the result of the last run was **15 checks passed, 0 failed**. The replica runs v0's exact versions, read on the real machine on 2026-10-06 (Nextcloud 33.0.2, Immich 3.2.1, Jellyfin 12.1, Vaultwarden 1.37.1, Syncthing 2.0.14), so the rehearsal includes the version steps the real move makes: Nextcloud 33.0.2 to 33.0.9, Immich 3.2.1 to 3.2.4, Syncthing 2.0.14 to 2.1.3.
Rehearsed in the lab on **2026-10-05** against a replica of v0 (`lab/v0-replica/`: the same services in Docker, seeded through their own APIs), without touching the real machine. The driver is [lab/v0-migration-u25.sh](../lab/v0-migration-u25.sh); the result of the last run was **15 checks passed, 0 failed**. The replica runs v0's exact versions, read on the real machine on 2026-10-06 (Nextcloud 33.0.2, Immich 3.2.1, Jellyfin 12.1, Vaultwarden 1.37.1, Syncthing 2.0.14), so the rehearsal includes the version steps the real move makes: Nextcloud 33.0.2 to 33.0.9, Immich 3.2.1 to 3.2.4, Syncthing 2.0.14 to 2.1.3. *(Update 2026-10-22: the rehearsal ran with Nextcloud 33.0.2. After PHP2Shell (CVE-2026-109618, CVE-2026-109619) the owner updated v0's Nextcloud by hand to 33.0.10 on PHP 8.4.27, read on the real machine; the replica's pin now says so, and the rehearsal was not repeated.)*

## What the rehearsal proves, and what it does not

Expand Down Expand Up @@ -36,7 +36,7 @@ Measured on the replica: Immich dump 3 s, Nextcloud conversion 18 s, everything

## Differences to check on the real machine

- **Nextcloud's patch step is rehearsed**: v0 is on 33.0.2 and the module on 33.0.9; the first start ran the upgrade (`occ upgrade`) without incident and everything verified. Nothing is left to check here except the real data's size.
- **Nextcloud's patch step is rehearsed**: v0 was on 33.0.2 and the module on 33.0.9; the first start ran the upgrade (`occ upgrade`) without incident and everything verified. v0 is now on 33.0.10 (hand update, 2026-10-22) and the module also on 33.0.10, so the real move has no version step for Nextcloud and `occ upgrade` finds nothing to do. Nothing is left to check here except the real data's size.
- **Syncthing 2.0.14 to 2.1.3 is rehearsed** (the replica runs 2.0.14): the device ID and the folder list survive. What the real index database holds, and how long it takes to settle, depends on the real data.
- **Jellyfin media**: v0 has two media trees, and the libraries point at their container paths (`/media`, `/media2`). Both go on the 16 TB disk, and `services.jellyfin.mediaMounts` maps each container path to its folder there (the private `host.nix`); the tree that was on the 2 TB disk is copied to the 16 TB disk **before the 2 TB disk is formatted** (runbook 1.1 and 1.2).
- **Time Machine**: v0's partition is HFS+, which Linux cannot write when it is journaled; it is made ext4 and the Mac starts a fresh backup, **after the move has settled** (runbook 1.2), and the host declares neither the share nor its mount until then.
Expand Down
2 changes: 1 addition & 1 deletion lab/v0-replica/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ services:
restart: unless-stopped
nextcloud:
container_name: nextcloud
image: nextcloud:33.0.2-apache # v0's real version, read on the real machine on 2026-10-06 (a floating tag would drift)
image: nextcloud:33.0.10-apache # v0's real version, read on the real machine on 2026-10-22 after the PHP2Shell patch (PHP 8.4.27; v0 runs the floating tag 33-apache, which would drift)
environment: [ "MYSQL_HOST=nextcloud-db", "MYSQL_DATABASE=nextcloud", "MYSQL_USER=nextcloud", "MYSQL_PASSWORD=v0ncpass", "REDIS_HOST=nextcloud-redis", "NEXTCLOUD_ADMIN_USER=admin", "NEXTCLOUD_ADMIN_PASSWORD=v0adminpass", "NEXTCLOUD_TRUSTED_DOMAINS=localhost cloud.v0.test", "OVERWRITEPROTOCOL=https", "TZ=Europe/Rome" ]
volumes: [ "/srv/v0/data/nextcloud/html:/var/www/html", "/srv/v0/data/nextcloud/data:/var/www/html/data" ]
ports: [ "127.0.0.1:8080:80" ]
Expand Down
6 changes: 3 additions & 3 deletions nixos/flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading