All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it

  • Mubelotix@jlai.luOPEnglish
    132·
    2 days ago

    All recently open issues are about this. I was a victim, but I’m not the first and people on reddit have done better investigations than I have. Look for the name of the process at the top

    • non_burglar@lemmy.worldEnglish
      32·
      2 days ago

      Thanks.

      For severe incidents like this, please post the most appropriate link, in this case https://github.com/umami-software/umami/issues/3852

      Admins in self hosted usually don’t have that much experience with real, active compromise and may panic, let’s help them as much as possible.

      I will add that Umami itself is not compromised, but vulnerable. That is a somewhat misleading title.

      What was the vector? Did you have umami exposed publicly?