With the big PHP vuln disclosure looming I want to highlight Nextcloud. A lot of y'all put stuff on Nextcloud. Nextcloud uses PHP. All PHP versions are vulnerable to this exploit and there's already code in the wild to get a shell on any server running PHP.

Nextcloud themselves say they can't do anything right now and advise you turn your servers off for the time being: https://github.com/nextcloud/server/issues/65754

This is bad. "Attacker gets all your stored data and a shell on your box" bad. Please shut down for now. If you are running Nextcloud exposed to the internet you are vulnerable.

You should shut down if you're running any PHP app at all, but I'm focusing on NC here because knowing what some people keep in theirs? The potential is very very bad.