News

Details: Last Updated: August 09, 2026

Security release!

BCMath:
- Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)

GD:
- Upgrade libgd. (CVE-2026-9672)

PGSQL:
- Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Phar:
- Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
- Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

8.5.9 - https://www.php.net/ChangeLog-8.php#8.5.9
8.4.24 - https://www.php.net/ChangeLog-8.php#8.4.24
8.3.33 - https://www.php.net/ChangeLog-8.php#8.3.33
8.2.33 - https://www.php.net/ChangeLog-8.php#8.2.33

Release URL: https://github.com/Bearsampp/module-php/releases/tag/2026.8.6

Details: Last Updated: August 06, 2026

Security release!

Security

Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m)
Implement POP3 failed login tracking and disconnect after multiple attempts
Redact POP3 password in debug logs to prevent credential exposure

Chore

Add ReadHeaderTimeout to HTTP server configuration
Update node dependencies
Update Go dependencies
Update caniemail database
Update Github Actions dependencies

Fix

Prevent protocol desynchronization by draining oversized message data
Prevent marking already deleted POP messages for deletion
Ensure deleted POP3 messages are excluded from LIST and STAT commands
Update content type handling for attachments to ensure proper file downloads
Sanitise active Content-Type in attachment downloads
Escape file names in Content-Disposition header for thumbnail responses
Allow passwords with spaces in POP3 authentication
Implement dot-stuffing for TOP commands in POP3 server
Correct order of setting headers and writing HTTP error response
Handle client disconnection during DATA read with appropriate logging in SMTPD server (#721)

Test

Add brute force POP3 login protection test
Add more WebSocket CORS tests
Enhance CORS middleware tests for HTML preview route handling

Release URL: https://github.com/Bearsampp/module-mailpit/releases/tag/2026.7.28

Details: Last Updated: August 06, 2026

Update to .NET SDK 10.0.302

Update branch for release (#27685)
Avoid calling credential provider for public feed for Wix (#27666)
Separate NuGet publish into its own stage after pushing the git tag (#27652)
PMC: Download deb_arm artifact to ensure package is available for PMC publish flow (#27653)

Release URL: https://github.com/Bearsampp/module-powershell/releases/tag/2026.7.30

Details: Last Updated: July 25, 2026

Security release!

https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97

Security

Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

Update Go dependencies
Update node dependencies

Release URL: https://github.com/Bearsampp/module-mailpit/releases/tag/2026.7.20

Details: Last Updated: July 25, 2026

4.0.0 - https://github.com/usebruno/bruno/compare/v3.5.3...v4.0.0
3.5.3 - https://github.com/usebruno/bruno/compare/v3.5.2...v3.5.3

Release URL: https://github.com/Bearsampp/module-bruno/releases/tag/2026.7.23

Page 2 of 68

1
2
3
4
5
6
7
8
9
10

Our Supporters

Joomdonation

AM Graphix

Sorry, this website uses features that your browser doesn't support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you'll be all set.