HA and the php vulnerability

Third party integrations
1

Hi,

Any news on the recent PHP vulnerability and HA?
CERT-EU - Critical Vulnerabilities in PHP

Is HA vulnerable and do we need to take action?

Thanks

2

Nextcloud update in reddit:

Nextcloud: Important update on the PHP issue

We have been informed by CERT of an issue affecting PHP, see their public statement at CERT-EU - Critical Vulnerabilities in PHP and the PHP statement atPHP: News Archive - 2026

This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data.

Critical: shut down your nextcloud until a security patch can be issued. Home Assistant OS and most smart home servers should be unaffected, and other cloud-based services like OneDrive seem to be unaffected.

3

HA core is written in python. I’ll leave the official response for the HA team.
In the mean time it wouldn’t be a bad idea to stop the following apps:

  • phpmyadmin
4

How … ? For the ones reading this thread

5

settings>apps>phpmyadmin>control: stop
or just uninstall if not needed anymore

6

If someone exposes phpmyadmin over the internet he/she is a fool and deserves to be hacked…

7

I found a github issue regarding the phpmyadmin issue.

8

All in all I think the php risk is minor because without being logged in to the HA frontend (which uses Python) you cannot access the phpmyadmin container (which uses php). But I just wanted to mention it. At least don’t leave it running.
And personally I don’t think there’s a real good reason to have phpmyadmin in HA at all. Perhaps temporary for some tests.

9

I hope you are not exposing HA directly to the internet. if so the vulnerability (in phpmyadmin) cannot be directly exploited.

If you use some sort of VPN or use NabuCasa cloud you are not exposing your instance, it is HA that opens the connection to NabuCasa cloud backend and so you don’t have open ports on your firewall.

The CVE is really really really dangerous for PHP based application exposed directly over the internet.

I have already updated my Nextcloud instance, but even that is locked behind my firewall and accessed only via VPN.

10

The question was whether or not ha is vulnerable for the php exploit. Until perhaps the HA people make an official statement.
I’m just trying to help here because no one replied to the OP.

11

care to explain why you want a statement regarding php in a python based application?

12

It is an app/add-on for managing databases. Unless you specifically installed it then it does not affect you.

13

There are a lot of people using remote access for HA via Cloudflare tunnel without opening ports on their router.

14

Home Assistant core does not use PHP. It’s not vulnerable.

If you have add-ons which expose stuff made with PHP, then there is a risk.