I got this email from Nitrokey today. I thought this might be interessting for the folks here, too.
I am pleased, that nitrokey is watching these security issues.
Has somebody any idea, how I might find out, if my box was already exploited?
Email from Nitrokey:
As a NextBox user we would like to inform about a critical security issue. According to the PHP developers, a critical PHP bug is circulating, and it appears to be partially exploited already.
Although we have no evidence that current NextBox/Nextcloud installations are affected, we recommend taking one of the following two measures if your NextBox allows access from the Internet:
Turn off the NextBox completely
Prevent connections from the Internet: Turn off the reverse proxy or turn off port forwarding
Most likely just until tomorrow; by then, there should be a corresponding update available. The update will then be automatically rolled out to your NextBox as soon as it’s available.
My understanding was that PHP will be releasing the PHP fix at 14:00 UTC 21 Oct 2026
Once the fix is released Nextbox will work on adding to Nextbox but also other bad actors will be working out where the vulnerabily is and making an exploit.
So it then becomes a race.
If you have switched your nextbox off before 14:00 UTC 21 Oct 2026 you should be ok
After that time it’s just down to luck whether you first get exploited or patched
Don’t know how to check if you have been exploited though
The mail is a copy from our blog post, which received some updates in the meantime:
tl;dr: We updated the images and pushed an update yesterday as soon as the images were available. We disabled the ‘Backwards Proxy’ feature temporarily reduce internet exposure of existing NextBoxes. We will enable it again today, as we expect all/most boxes to be updated already.
If you turned off your NextBox as precaution please follow the instructions in the blog post on how to safaly connect it back to the internet again (:
Can someone explain how critical this issue is? If someone has broken into the nextbox, is it a no brainer for a hacker to compromise the Operating System, or will he be only inside the docker container? Will he be thrown out again, if during the update a new Image is installed?
In the blog they say it should be Version 1.26.20. So it did not update. I am waiting for 10 hours now…
Or is this the wrong place to look for the version?
Is there any way to connect to the nextbox local only when i activated TLS? If I block my router ports, DNS forwards me to the closed ports and connection with local IP forwards the browser to the DNS or blocks cause the certificate does not belong to the address.
