Looking at the new EA console update we can see Ubiquiti patched Node.js2Shell on UniFi OS However, in order to do it they had to bundle it in with a major new release 5.X -> 6.X instead of shipping a minor release with just the security patch The new release also has an OS update moving from Debian 11 to 13 We think this is why it's been taking them so long, and UniFi OS Server is still unpatched and vulnerable over 72 hours later Rushing an OS and version change to patch a security vulnerability is a big risk for their customers Andrew on our team found a way to patch just Node.js on our servers, we aren't waiting any longer for Ubiquiti and hope to have this done today -Reilly

UISP 3.7.0 is Official now, patching Node2Shell and PHP2Shell vulnerabilities, everyone should update immediately Our UISP customers are already patched UniFi OS Server is still vulnerable and no update from Ubiquiti

We pushed an EA UISP version to all customers which patches both the Node.js and PHP RCEs We do not have a patch for UniFi OS Server (Node.js) from Ubiquiti yet, and are working on writing our own patch, we expect that to be ready tomorrow morning and will push to all servers immediately I'm not happy with the slow response from Ubiquiti on this one and in the future we will write our own patches quicker instead of waiting -Reilly

New high severity PHP and NodeJS security vulnerabilities were published yesterday Reilly and Andrew identified and patched all of our own HostiFi servers which are running PHP or NodeJS We are waiting for patches from Ubiquiti and we will push those out to our customers immediately once we have them: UISP has PHP exposure through UCRM UniFi OS Server also has exposure through NodeJS

Let's get it

We had some customers reporting an issue with UniFi APs that have mesh disabled, but they kept getting constant messages, such as "stopped mesh connection to parent." Ubiquiti has now thankfully fixed this bug, with UniFi Network 10.6.101.

If you're having issues accessing the Settings page on UniFi OS Server, update to Network 10.6.106 as this "Fixed an issue where Site Admins could fail to open Settings in multi-site deployments." From our testing, the access to Settings only seems to be an issue some types of users. Owner and full management admins can access.

New Ubiquiti Community app now available for iOS, previously it was inside of the UniFi Design app apps.apple.com/gb/app/unifi-…

Name all the @Ubiquiti devices you see

Can't log into your HostiFi server with your UI account? Server offline in Site Manager? Reilly shows how to fix it in this 2min video cap.so/s/j8c1y5qcvk27kcb

In other news, if you are having DHCP issues and are running switch firmware version 7.5.10 on Pro or Pro Max, try rolling back to firmware version 7.4.1 Lots of our customers have been experiencing this same issue and the firmware roll back is the fix for now

We're on it UniFi OS (Server 5.1.21 → 5.1.37; consoles 5.1.26 → 5.1.31; NAS 5.1.32) 10.0 Critical — CRLF bug, no login, bypasses auth 9.9 Critical — low-priv access control, escalate on the device 9.9 Critical — low-priv access control, escalate on the device 9.1 Critical — admin command injection on UOS Server 9.1 Critical — admin command injection on UOS Server 9.0 Critical — leftover debug code, escalate under some conditions 9.0 Critical — CRLF bug under some conditions UniFi Network (10.4.57 → 10.5.67) 9.1 Critical — admin command injection on an adopted device 9.1 Critical — admin access control, escalate inside Network UniFi Protect (7.1.87 → 7.2.105) 10.0 Critical — no login, command injection on the host 9.9 Critical — low-priv command injection on the host 9.9 Critical — low-priv command injection on the host UniFi Talk (5.2.7 → 5.3.2) 10.0 Critical — no login, command injection on the host UniFi Access (4.3.3 → 4.3.5) 9.9 Critical — low-priv command injection 9.9 Critical — low-priv command injection 9.9 Critical — low-priv command injection 9.9 Critical — low-priv access control, take over the host UniFi Enterprise Audio/Video Bridge (1.0.10 → 1.0.11) 9.8 Critical — no login, command injection on the device UniFi Protect AI Key (2.1.3 → 2.2.6) 9.8 Critical — no login, privilege escalate on the device UID Enterprise Agent (1.61.8 → 1.62.1) 9.1 Critical — admin command injection UniFi Connect Display Cast Pro (1.0.108 → 1.0.111) 9.0 Critical — access control, escalate under some conditions UniFi Connect (3.24.20 → 3.24.22) 8.2 High — no login, escalate inside Connect (can chain to the host)

New app design released! This is more than a fresh look, it's an improved user experience We spent months in the details - How can we make this easier to understand? How can we reduce the number of words you need to read? How can we reduce the number of clicks? Reilly takes it seriously because we can never get back the minutes we wasted navigating bad app designs

In case you can't find them, Ubiquiti has for some reason, hidden the UXG Gateways on its store 🤦 You now need to go to Accessories > Advanced Hosting

Kevin Andrew and Reilly at UniFi Toronto Conference yesterday

Another 5 star review, thanks Jef! Migrating to HostiFi couldn't be easier, and we can even help you from start to finish when you purchase any UniFi or UISP plan, which start from $19 per month. Learn more hostifi.com/#pricing

AI agents can connect directly into your UniFi server Not just to chat but to actually do the work for you Agents can diagnose, optimize, and configure the networks right in your browser window

Ubiquiti just released the brand new UPS 2U Pro, but why should you care? - Larger 720Wh battery (216Wh on UPS 2U) - Longer runtime (22 mins vs 8 mins runtime) - Built in kill switch for emergency power off - Still lead acid, Ubiquiti need to release Li-ion models Only available in the US, hopefully coming to more countries soon. store.ui.com/us/en/category/… - Alex

Ubiquiti is now showing when items went out of stock, and more importantly WHEN they'll be back in stock again! 👏 - Alex