IanTwenty

They didn’t move fast enough on it and others began circulating it. So they had to play catch up, hence the need to react before they had a patch.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

I do not run Immich but their privacy policy states:

Locally Stored Data: Immich stores all your photos, albums, settings, and other metadata locally on your device. We do not have access to this data, nor do we transmit or store it on any of our servers.

https://immich.app/privacy-policy

Additionally in their docs I can find no mention of connecting to outside services. I do see references to downloading hugging face models.

https://docs.immich.app/features/facial-recognition#how-face-detection-works

One of the newswire articles is a great read

https://blog.colinbreck.com/i-dont-want-to-read-what-you-didnt-write/

Perhaps the laziest and most offensive use of AI writing I have seen: I had someone use AI to summarize my comments on their proposal as their response to me! Thanks! I couldn’t have said it better myself!

So if I understand: hosters will be able to provide the proof at a time/schedule of their choosing. On actual servers a simpler, automated cert renew process without the need for them to hold nameserver API credentials.

Say that new authelia exploit looks like one fail2ban already recognises or relies on timing/brute-force then you’re covered even before a patch is available.

Here’s a real authelia vuln:

https://app.opencve.io/cve/CVE-2026-47203

allowing an attacker to circumvent login throttling or account lockouts by simply altering the case of their credentials.

I think fail2ban would help protect authelia here?

Firewalling containers’ outbound access seems to be rare but another powerful layer of protection