Follow
🔒 Castopod 1.15.6 is out!
Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated remote code execution on servers running PHP below 8.4.27.
🐳 Castopod's code hasn't changed: this release only moves our Docker image to PHP 8.4.27. Docker users: pull castopod/castopod:1.15.6 and restart.
🖥️ Running Castopod on your own server? Updating Castopod won't help: update PHP to 8.4.27 or later now!
👉 https://code.castopod.org/adaures/castopod/-/releases/v1.15.6
@Castopod I was in the process of updating php (and castopod—I'd been lagging behind a bit) as this version dropped.