All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it

    • Mubelotix@jlai.luOPEnglish
      0·
      3 days ago

      All recently open issues are about this. I was a victim, but I’m not the first and people on reddit have done better investigations than I have. Look for the name of the process at the top

      • non_burglar@lemmy.worldEnglish
        1·
        3 days ago

        Thanks.

        For severe incidents like this, please post the most appropriate link, in this case https://github.com/umami-software/umami/issues/3852

        Admins in self hosted usually don’t have that much experience with real, active compromise and may panic, let’s help them as much as possible.

        I will add that Umami itself is not compromised, but vulnerable. That is a somewhat misleading title.

        What was the vector? Did you have umami exposed publicly?