News

Details: Last Updated: September 23, 2026

Security release!

Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
Security: Only follow HTTP redirects from HTTP responses (#12948)
Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)

https://github.com/composer/composer/compare/2.10.1...2.10.2

Release URL: https://github.com/Bearsampp/module-composer/releases/tag/2026.7.10

Details: Last Updated: September 23, 2026

Security release!

https://www.oracle.com/security-alerts/cspujun2026.html#AppendixMSQL

https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-1.html

Release URL: https://github.com/Bearsampp/module-mysql/releases/tag/2026.7.10

Details: Last Updated: September 23, 2026

Security release!

https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97

Security

Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

Update Go dependencies
Update node dependencies

Release URL: https://github.com/Bearsampp/module-mailpit/releases/tag/2026.7.20

Details: Last Updated: September 23, 2026

Security release!

Security

Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m)
Implement POP3 failed login tracking and disconnect after multiple attempts
Redact POP3 password in debug logs to prevent credential exposure

Chore

Add ReadHeaderTimeout to HTTP server configuration
Update node dependencies
Update Go dependencies
Update caniemail database
Update Github Actions dependencies

Fix

Prevent protocol desynchronization by draining oversized message data
Prevent marking already deleted POP messages for deletion
Ensure deleted POP3 messages are excluded from LIST and STAT commands
Update content type handling for attachments to ensure proper file downloads
Sanitise active Content-Type in attachment downloads
Escape file names in Content-Disposition header for thumbnail responses
Allow passwords with spaces in POP3 authentication
Implement dot-stuffing for TOP commands in POP3 server
Correct order of setting headers and writing HTTP error response
Handle client disconnection during DATA read with appropriate logging in SMTPD server (#721)

Test

Add brute force POP3 login protection test
Add more WebSocket CORS tests
Enhance CORS middleware tests for HTML preview route handling

Release URL: https://github.com/Bearsampp/module-mailpit/releases/tag/2026.7.28

Details: Last Updated: September 23, 2026

Security release!

libgd patch for CVE-2026-9672 in fcd691b377

8.5.10 - https://php.watch/versions/8.5/releases/8.5.10#changelog

8.4.25 - https://php.watch/versions/8.4/releases/8.4.25#changelog

Release URL: https://github.com/Bearsampp/module-php/releases/tag/2026.8.27

Page 3 of 73

1
2
3
4
5
6
7
8
9
10

Our Supporters

Tassos gr

AM Graphix

Joomdonation

Sorry, this website uses features that your browser doesn't support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you'll be all set.