This is the latest from Nimbus:
This patch is to address vulnerabilities reported in CVE-2026-109618 and CVE-2026-10961 -- and covers these version:
v81: ea-php8.1.34-5
v82: ea-php82 8.2.35
For more detailed information, you may also check this page...
They didn’t take anything down (or tell customers) but they just did the mitigations, the multi part stuff, etc. They’re rolling the patches out in stages now. They say they’re patching 8.1 too.
Still waiting on Nimbus... :-(
If it helps anyone, if your host has done the temporary mitigation stuff to disable the multipart form submsision, disabling javascript at least lets you login to admin panel, make a post, add a notice, etc so you can let your users know what's happening.
Anyone still with Nimbus?
I’ve just realised our site has been inactive since midday as it looks like they’re blocking nginx requests while they try to fix this PHP security issue.
No communication at all from them though and annoyingly I know we’re running old XF on 8.1 so this is probably...
Yeah but things like providing it the idiomatic examples from decent open source addons feels like it can mitigate this a bit (just like giving a junior dev should existing code base to use as an example).
I know it’s a risk but with some care to feels like there’s potential.
I use Claude quite a bit for work (primarily in Python) and got curious just what it could do in XF.
What I did was:
Gave it clear instructions on the scope of the addon I wanted to make
Showed in both the XF code codebase as well as examples of other open source XF addons so it learnt the...
Trying to figure out if this is a cloudflare issue or Nimbus issue.
Since we were forced to "upgrade" our Nimbus server, any adsense revenue has dropped off a cliff and is practically nothing. Adsense is failing to crawl the site and can't find ads.txt which I think is the cause. I don't know...
Yep, I probably bugged Tim more than I should have but he was excellent and the support was the main reason we stuck with them. Such a shame he "sold out" to these guys.
Yeah, so the "missing" hour will be on the old server but my question is, is it reasonable for them to have lost an hour of posts? Is that how long it'd have taken to do a final resync of the database? Or could they have migrated everything then done a final update in minutes (which was my...
Well they randomly migrated my server this evening without telling me, despite me asking all week for an update and a schedule.
Before I complain at them too much, I'd like to get a little adice (@MattW, @Slavik?). We're a football forum. They randomly migrated us during a match which is about...