LoginSign Up
← Back to all sparks
M

Mailu

COMMS
Velocity5.0

Self-hosted mail server suite with webmail and admin interface

mailu.io ↗

Mailu's October: patched PHP for webmail, and a resolver that reports DNS failures

maintenance-branchroundcubecve-patchingself-hosted-maildns-resolver
◆Current state
Mailu's 2024.06 branch ships pinned releases, each tied to a single issue. October brought resolver fixes for the DNSSEC KSK rollover and SERVFAIL healthchecks, Roundcube 1.6.20, then PHP2Shell CVE mitigations in webmail followed by the patched PHP runtime. 2024.06.68 on 8 November carries the same PHP2Shell mitigation note again.
◆Where it's heading
The project remains in one-fix-per-release maintenance on the 2024.06 line, with upstream webmail and PHP security driving much of the cadence. Nothing in the entries points to a new main release.
◆Prediction
The next releases will most likely follow upstream Roundcube or PHP security fixes, as three of the last six did.

◆Recent moves

  1. 5d ago

    2024.06.68 re-ships the PHP2Shell webmail mitigation

    The release note repeats the PHP2Shell mitigation from 2024.06.66, after 2024.06.67 already shipped the patched PHP runtime. It reads as a re-release on the maintenance branch rather than a new fix.

    View source ↗
  2. 22d ago

    Mailu ships patched PHP for PHP2Shell CVEs

    The follow-up to 2024.06.66 ships the patched PHP runtime for the same two PHP2Shell CVEs in webmail. Operators should pull this release.

    View source ↗
  3. 22d ago

    Mailu mitigates PHP2Shell webmail CVEs

    Mailu's 2024.06 branch mitigates known PHP2Shell attack paths (CVE-2026-109618 and CVE-2026-109619) in webmail while a patched PHP runtime was pending.

    View source ↗
  4. 24d ago

    Mailu 2024.06.65: Roundcube 1.6.20 update

    A Mailu 2024.06 image rebuild that picks up Roundcube 1.6.20. Dependency maintenance on the stable branch.

    View source ↗
  5. 1mo ago

    2024.06.64 re-ships the resolver healthcheck fix

    A re-release of the SERVFAIL healthcheck fix.

    View source ↗
  6. 1mo ago

    2024.06.63 makes the resolver healthcheck catch SERVFAIL

    The resolver healthcheck now fails when unbound returns SERVFAIL instead of reporting healthy.

    View source ↗