Per the PHP Foundation's recommendation, we've updated the configuration to block a potential attack vector. We recommend to upgrade your servers. We've also made it easier to downgrade Nextcloud to help you in situations where you skipped a major Nextcloud release during an upgrade. An updated guide is on our forum: https://forum.selfprivacy.org/t/how-to-downgrade-nextcloud/58

We've pushed the PHP fix. Upgrade your servers as soon as possible. Feel free to re-enable Nextcloud and Roundcube after you make sure that your server upgraded successfully. Upgrade before enabling services. After this, check the PHP version in Nextcloud: log in as an admin, go to Administration Settings (in a menu when you click your avatar), go to System tab (the last one on the left) and scroll down to the PHP section. You will see PHP version there. It must be 8.4.27. If it is 8.4.26, you're still vulnerable: disable Nextcloud (and Roundcube) and report this to us.

We've pushed an update that disables PHP software. Upgrade your servers immediately or disable both Nextcloud and Roundcube. This will make your Nextcloud unavailable for some time. We expect that in less than two hours there will be mass attacks on sites running PHP. Applying the fix will take some more time after the vulnerability is disclosed. If you have any issues feel free to contact us in the support chat.