NextBox: PHP Exploit - Act Now!

According to the PHP developers, a critical PHP bug is circulating, and it appears to be partially exploited already.

Although we have no evidence that current NextBox/Nextcloud installations are affected, we recommend taking one of the following two measures if your NextBox allows access from the Internet:

•     Turn off the NextBox completely
•     Prevent connections from the Internet: Turn off the reverse proxy or turn off port forwarding

Most likely just until tomorrow; by then, there should be a corresponding update—we’ll post an update here accordingly.

The update will then be automatically rolled out to your NextBoxes as soon as it’s available.

Update: We temporarily disabled the 'Backwards Proxy' feature of Nextbox on our side to limit the impact of this exploit until updates are applied or mitigations are in place.

Update 2: Updated NextBox packages are out - Version 1.26.20 should appear in your NextBox App within the next 4 hours. We are waiting with the 'Backwards Proxy' re-activation until tomorrow. If you have turned off your NextBox as a precaution and want to turn it on again please make sure to disable access from the internet to the NextBox as the first step (e.g. via port forwarding or backwards proxy). Then wait at least four hours for the update to apply. Afterwards check that you are on at least NextBox version 1.26.20 and only then enable access from the internet again.