TomWis97

This is not relevant, an attack can also come from within the network. For example through a compromised machine. There's absolutely no excuse this has no official announcement yet from Unraid. Even worse, from what I could find it looks like php-fpm runs as root. (Yes, the web UI's task is to do management stuff, but running whole php-fpm as root for that is terrible practice.) We're all trusting Unraid with our data, and yet it does not feel like they're taking our security seriously. (Not only this CVE, but a while ago during one of these events Unraid also took their time with responding.) Especially with the current pricing, I'm expecting better than this. @ironicbadger Can we expect a new Unraid version with a patched PHP either today or tomorrow?

Obviously you should minimize the amount of devices having access to SSH on the machine. But that's best-practice anyway. According to the Ubuntu documentation, you could configure LoginGraceTime: https://ubuntu.com/security/CVE-2024-6387 For doing this in Unraid: Check if /boot/config/ssh/sshd_config already exists. If not: cp /etc/ssh/sshd_config /boot/config/ssh/sshd_config Configure "LoginGraceTime 0", I also recommend adding a comment. Restart SSH (Settings --> Management access --> Set "Use SSH" to "off", apply, turn on again and apply again). Or restart the machine.