All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it

  • non_burglar@lemmy.worldEnglish
    32·
    2 days ago

    Thanks.

    For severe incidents like this, please post the most appropriate link, in this case https://github.com/umami-software/umami/issues/3852

    Admins in self hosted usually don’t have that much experience with real, active compromise and may panic, let’s help them as much as possible.

    I will add that Umami itself is not compromised, but vulnerable. That is a somewhat misleading title.

    What was the vector? Did you have umami exposed publicly?