We've received questions about the recently disclosed PHP vulnerabilities (PHP2Shell) and whether Hudu is affected. Hudu is is not vulnerable. Hudu's codebase does not use PHP, so no action is needed for cloud-hosted customers or for self-hosted customers using our current setup.
Self-hosted customers using SWAG
Some older self-hosted instances were set up with SWAG as the reverse proxy. Our setup guides no longer use SWAG, but existing instances may still be running it. The Hudu application itself is not affected, but SWAG includes PHP as part of its container. If your instance is still using SWAG, we recommend migrating to nginx, which is what our current self-hosted setup guides use.
Checking whether you're using SWAG
Open the docker-compose.yml file in your ~/hudu2 directory and check the image listed for your reverse proxy. If it references linuxserver/swag or linuxserver/letsencrypt, follow our Swag to NGINX migration guide.
FAQ
No. Cloud-hosted instances are not affected and no action is needed.
No. If you're using the setup from our current self-hosted guides, no action is needed.
The Hudu application does not use PHP. Because SWAG includes PHP in its container, we recommend migrating to NGINX to stay aligned with our supported setup.