This is a security fix with several module security fixes included, including php both in the core engine and in modules for php 8.2, 8.3, 8.4, & 8.5
News
Xlight 3.9.5 Security Release
- Details
Security release!
3.9.5(2026-7-1)
- Fixed three security vulnerabilities.
- Add support for ECDH Key Exchange algorithm (ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521).
- Add support for AES-GCM encryption algorithm (
This email address is being protected from spambots. You need JavaScript enabled to view it. ,This email address is being protected from spambots. You need JavaScript enabled to view it. ). - Add support for (ETM) Encrypt-then-MAC hmac algorithm (
This email address is being protected from spambots. You need JavaScript enabled to view it. ,This email address is being protected from spambots. You need JavaScript enabled to view it. ). - Fixed a few GUI bugs.
Bearsampp August Security Upgrade released
- Details
Security Release
Mailpit 1.31.1 Security Release!
- Details
Security release!
Security
- Add
--allowed-hostsflag to mitigate DNS rebinding against the API
Chore
- Update Go dependencies
- Update node dependencies
- Update Github Actions
Fix
- Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
- Pass line-boundary state to drainData to prevent SMTP desync
- Allow SP inside quoted local-parts per RFC 5321 (#731)
- Bound header-rewrite scanner to header block and fail closed on missing header
- Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup
Composer 2.10.3 Security fix Released
- Details
Security release!
Security: Validate package bin paths against path traversal using symlinks (GHSA-96h3-5x6v-m776, CVE-2026-59944)
Security: Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)
Security: Sanitize URL-embedded usernames/token in a few more places (#13044)
Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#12988)
Fixed PHP 8.6 deprecation warnings (#12967, #13028)
Fixed error output when a policy blocks a package version to be clearer (#12993)
Fixed the lock file's content-hash with a conflict marker ending up breaking at runtime (#13048)
Fixed possible race condition while creating directories like the cache dir when running multiple Composer processes in parallel (#12977)
Fixed forgejo support to handle empty repositories better (#12968)
Fixed FilterListApiClient not forwarding transport options (#13040)
Mariadb 13.0.2 Released
- Details
https://mariadb.com/docs/release-notes/community-server/changelogs/13.0/13.0.2
