odio - almost - untouched by this week's security storm 🛡️

[b0bbywan]

This week brought several widely covered security issues, including PHP2Shell (remote code execution in PHP), Node2Shell (remote code execution through the Brotli decoder used by Node.js) and the eMudhra certificate authority key compromise. You may have heard about those, so here is where odio stands.

Issue	CVE	Status
PHP2Shell	CVE-2026-109618, CVE-2026-109619	✅ Not affected
Node2Shell	CVE-2026-111497	⚠️ Optional kiosk only
eMudhra CA compromise	CVE-2026-111943	⚠️ Handled by Debian and the kiosk, except qbzd
UPnP/DLNA (upmpdcli)	Upstream site offline	⚠️ Upgrades blocked

PHP2Shell: not affected

odio ships no PHP. Its services are written in Go, C, C++ and Rust (plus Python for the MPRIS bridges), which is also what keeps odio running on armhf boards.

PHP advisories: GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp

Node2Shell: odio's services are not exposed

odio ships no Node.js. The project's websites (odio.love, docs.odio.love) are static sites, with no Node.js running behind them. The optional kiosk is affected, see below.

Node.js advisory: October 2026 security releases

The optional kiosk: trusted pages only

The kiosk (off by default, amd64 and arm64 only) runs on Debian's QtWebEngine 6.8.2. It is built on Chromium 122 with security fixes up to Chromium 132 (January 2025), and Debian doesn't ship security updates for it: it considers QtWebEngine safe only for displaying trusted content, not for general web browsing.
Besides Node2Shell, it misses every Chromium fix since then, including ten flaws known to be exploited in the wild, mostly in the V8 JavaScript engine.

Exploited Chromium flaws fixed after Chromium 132 (from CISA's Known Exploited Vulnerabilities catalog)

• CVE-2025-5419: V8, out-of-bounds read and write
• CVE-2025-6554: V8, type confusion
• CVE-2025-10585: V8, type confusion
• CVE-2025-13223: V8, type confusion
• CVE-2025-14174: out-of-bounds memory access
• CVE-2026-2441: CSS, use-after-free
• CVE-2026-3910: V8, memory buffer bounds
• CVE-2026-11645: V8, out-of-bounds read and write
• CVE-2026-85046: V8, type confusion
• CVE-2026-87491: V8, out-of-bounds write

It also carries its own built-in list of trusted roots instead of using the system one, so Debian's eMudhra fix doesn't reach it. Since odio-kiosk 2.0.1, it marks the compromised certificates as distrusted itself, on every start (see below).

Two things limit the risk. The kiosk runs as a regular user with Chromium's sandbox, so a malicious page stays confined unless it also exploits a sandbox escape. And by default it only shows odio's dashboard and the services it links to. Keep it that way: only open pages you trust.

eMudhra CA compromise: handled by Debian

Debian stopped trusting the affected roots in ca-certificates 20250419+deb13u1. SD images apply it automatically through unattended-upgrades. On a live install, run:

sudo apt update && sudo apt upgrade

odio's services rely on the system certificate store, so they follow. One exception, off by default: qbzd (Qobuz Connect), which bundles its own root list and still trusts the affected root. It must be rebuilt to be fixed.

The kiosk is fixed in odio-kiosk 2.0.1, installed by the same apt upgrade. QtWebEngine still gets no updates, so the kiosk distrusts the certificates itself: the compromised eMudhra intermediates and the two roots Debian removed. It does the same for the roots Chrome has distrusted since QtWebEngine's Chromium was released: Entrust, Chunghwa Telecom and NetLock.

Debian: DSA-6572-1 · Mozilla: Compromised eMudhra intermediate certificates

Keep your odio up to date

SD images install Debian security updates automatically through unattended-upgrades. On a live install, I strongly recommend doing the same:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Security updates then install daily in the background.

Only run odio on a trusted network

odio is built for your home network: its services have no authentication, and some of its components keep their own certificate lists. Keep it behind your router, and don't expose it to the internet or run it on networks you don't control.

If you customized your odio

odio is meant to be configured freely, so your setup may go beyond what is shipped:

• PHP services you added: Debian has fixed PHP (DSA-6574-1). Update now with sudo apt update && sudo apt upgrade, then restart your web server or PHP-FPM (for example sudo systemctl restart php8.4-fpm or sudo systemctl restart apache2) so it loads the fixed PHP.
• Node.js services you added: Debian's Node.js is not fixed yet. Stop the service, or switch to an upstream release that includes the fix (22.23.4, 24.22.1 or 26.12.1).
• Python apps you added in a virtualenv or with uv: these bring their own certificate bundle instead of the system one. Upgrade to certifi 2026.10.19 and uv 0.13.4 or later.
• Kiosk pointed at other pages, or extra links in odio-api: QtWebEngine stays unpatched, so only open pages you trust.

UPnP/DLNA: upstream down

lesbonscomptes.com, the PHP site that hosts upmpdcli and its apt repository, currently redirects to its hosting provider's maintenance page. Until it comes back:

• an odio with UPnP/DLNA installed keeps working, but can't upgrade (apt fails on the unreachable repository);
• for a new install, answer N to UPnP/DLNA; The SD images continue to ship upmpdcli.
• new odio releases are on hold.

This also shows a weak spot in how odio sources its packages: upmpdcli comes from a single upstream repository with nothing to fall back on, so one site going offline is enough to block upgrades and releases. I'll fix that once lesbonscomptes.com is back, or sooner if the outage drags on.

---

I should post an update when lesbonscomptes.com is back.

[b0bbywan]

Update: odio-kiosk 2.0.1 is out. QtWebEngine still gets no security updates, but the kiosk no longer trusts the compromised eMudhra certificates: it marks them as distrusted in its own certificate store on every start. It also distrusts the CAs Chrome has dropped since QtWebEngine's Chromium was released (Entrust, Chunghwa Telecom, NetLock).

If you enabled the kiosk, upgrade it by hand, SD images included: unattended-upgrades doesn't cover the odio repository.

sudo apt update && sudo apt install --only-upgrade odio-kiosk
systemctl --user daemon-reload
systemctl --user restart 'odio-kiosk@*.service'