Security advisory: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and what Roundcube Plus users need to do.
On October 21, PHP released security updates for two critical vulnerabilities, known as PHP2Shell, that allow unauthenticated remote code execution. The flaw is in the PHP runtime itself, not in Roundcube webmail or in Roundcube Plus. Any application running on unpatched PHP, including Roundcube webmail, is exploitable.
All Roundcube Plus (RC+) plugins are compatible with PHP 8.0 and above, so you can upgrade PHP immediately without delay. If you are running an older release of our plugins, update them to the latest version first; older releases may not support the PHP version you are moving to.
| Your PHP | Upgrade to |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 | Debian/Ubuntu: 8.1.34-9 · Other distros: 8.2.35+ unless your vendor has backported the fix |
| 8.0 | Debian/Ubuntu: 8.0.30-25 · Other distros: 8.2.35+ unless your vendor has backported the fix |
PHP 8.0 and 8.1 are no longer updated by PHP.net; patched packages are available only from some platforms. If none exists for yours, move to 8.2.35 or newer.
All Roundcube Plus plugins continue to work on the patched releases.
Questions: Contact Us
