š Castopod 1.15.6 is out!
Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619) allow unauthenticated remote code execution on servers running PHP below 8.4.27.
š³ Castopod's code hasn't changed: this release only moves our Docker image to PHP 8.4.27. Docker users: pull castopod/castopod:1.15.6 and restart.
š„ļø Running Castopod on your own server? Updating Castopod won't help: update PHP to 8.4.27 or later now!
š https://code.castopod.org/adaures/castopod/-/releases/v1.15.6
Castopod :podcasting2:
npub19jā¦0pymw
2026-10-21 23:14:52 UTC
Author Public Key
npub19jkpuft2af6pdavpcavygk8n5r3q97kcyu0ft06dwvgaky79f5asg0pymwSeen on
wss://relay.momostr.pinkPublished at
2026-10-21 23:14:52 UTCEvent JSON
{
"id": "a458e576081cf6a34c8292622985126d3f4806b1ebc9c215250166b30ef4ffff",
"pubkey": "2cac1e256aea7416f581c7584458f3a0e202fad8271e95bf4d7311db13c54d3b",
"created_at": 1792624492,
"kind": 1,
"tags": [
[
"proxy",
"https://podlibre.social/@Castopod/117481438703927106",
"web"
],
[
"proxy",
"https://podlibre.social/users/Castopod/statuses/117481438703927106",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://podlibre.social/users/Castopod/statuses/117481438703927106",
"pink.momostr"
],
[
"-"
]
],
"content": "š Castopod 1.15.6 is out!\n\nTwo critical PHP vulnerabilities (CVE-2026-109618 \u0026 CVE-2026-109619) allow unauthenticated remote code execution on servers running PHP below 8.4.27.\n\nš³ Castopod's code hasn't changed: this release only moves our Docker image to PHP 8.4.27. Docker users: pull castopod/castopod:1.15.6 and restart.\n\nš„ļø Running Castopod on your own server? Updating Castopod won't help: update PHP to 8.4.27 or later now!\n\nš https://code.castopod.org/adaures/castopod/-/releases/v1.15.6",
"sig": "cd0271c9df4ecd15e933c96b524e6df824cc8663ee763ec4909557b24d659389395a8bc631d7da017b1bc370e01beb0e1aa19665be498242ab0ca91ae909a2f8"
}