security

Security advisory: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and what Roundcube Plus users need to do.

On October 21, PHP released security updates for two critical vulnerabilities, known as PHP2Shell, that allow unauthenticated remote code execution. The flaw is in the PHP runtime itself, not in Roundcube webmail or in Roundcube Plus. Any application running on unpatched PHP, including Roundcube webmail, is exploitable.

Version 2.4 of the Roundcube Plus Calendar plugin is now available. This major upgrade closes a large number of security issues found during a thorough audit, rebuilds the front end on the modern Alpine.js framework, updates FullCalendar to the latest version, and fixes a wide range of functionality bugs. If you're running an earlier version, we recommend upgrading as soon as possible.