**Castopod** @Castopod@podlibre.social · 2026-10-21T23:14:52Z

🔒 Castopod 1.15.6 is out!

Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated remote code execution on servers running PHP below 8.4.27.

🐳 Castopod's code hasn't changed: this release only moves our Docker image to PHP 8.4.27. Docker users: pull castopod/castopod:1.15.6 and restart.

🖥️ Running Castopod on your own server? Updating Castopod won't help: update PHP to 8.4.27 or later now!

Oct 21, 2026, 23:14 · · Web · · ·

**Optional** @Optional@dice.camp · Oct 21, 2026, 23:34

**Optional** @Optional@dice.camp · Oct 21, 2026, 23:34

Optional @Optional@dice.camp

@Castopod I was in the process of updating php (and castopod—I'd been lagging behind a bit) as this version dropped.

**Alexey Skobkin** @skobkin@gts.skobk.in · Oct 22, 2026, 00:21

**Alexey Skobkin** @skobkin@gts.skobk.in · Oct 22, 2026, 00:21

Alexey Skobkin @skobkin@gts.skobk.in

@Castopod Be prepared for new potential CVE's tomorrow. Looks like it's not the end of the story...