# Security update version 78 posted & PHP security vulnerability

**URL:** <https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082>\
**Category:** Announcements\
**Created:** [October 22, 2026, 6:55pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082 "2026-10-22T18:55:07Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![JoshData](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/joshdata/32/2153_2.png) [@JoshData](https://discourse.mailinabox.email/u/JoshData)\
**Post date:** [October 22, 2026, 6:55pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/1 "2026-10-22T18:55:07Z")

</div>

I’ve just posted version 78. Although it includes a security update to Roundcube, the bigger issue this week was major security issues in PHP.

Updates to PHP are available through the normal Ubuntu update commands. Log into your box with ssh and then run:

```sh
apt-get update
apt-get upgrade

```

For more see [Advice/Quick requirements related to the PHP vuln? - #25 by ice2k2](https://discourse.mailinabox.email/t/advice-quick-requirements-related-to-the-php-vuln/17058/25).

To upgrade Mail-in-a-Box to get the latest Roundcube (see the [CHANGELOG](https://github.com/mail-in-a-box/mailinabox/blob/main/CHANGELOG.md)), run the same command you used to install Mail-in-a-Box. See [Mail-in-a-Box Maintenance Guide](https://mailinabox.email/maintenance.html#upgrade) for more instructions.

---

<div class="post-metadata">

**Author:** ![eXTric](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/e/bb73d2/32.png) [@eXTric](https://discourse.mailinabox.email/u/eXTric)\
**Post date:** [October 23, 2026, 7:18am UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/2 "2026-10-23T07:18:42Z")

</div>

After the updates you can run following test for additional peace of mind

> **[Free PHP2Shell scanner - CVE-2026-109618 & CVE-2026-109619](https://pentest-tools.com/network-vulnerability-scanning/php2shell-scanner)**
>
> Free PHP2Shell scanner for CVE-2026-109618 and CVE-2026-109619, the critical RCE flaws in PHP core. Check your targets and get a PDF scan report.

---

<div class="post-metadata">

**Author:** ![Gideon-IT-UK](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/g/a5b964/32.png) [@Gideon-IT-UK](https://discourse.mailinabox.email/u/Gideon-IT-UK)\
**Post date:** [October 23, 2026, 11:36am UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/3 "2026-10-23T11:36:53Z")

</div>

Thanks for getting a new version to address these issues so quickly.

---

<div class="post-metadata">

**Author:** ![Gideon-IT-UK](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/g/a5b964/32.png) [@Gideon-IT-UK](https://discourse.mailinabox.email/u/Gideon-IT-UK)\
**Post date:** [October 23, 2026, 11:42am UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/4 "2026-10-23T11:42:03Z")

</div>

Thanks for this!

---

<div class="post-metadata">

**Author:** ![bluetardis](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/bluetardis/32/2119_2.png) [@bluetardis](https://discourse.mailinabox.email/u/bluetardis)\
**Post date:** [October 23, 2026, 9:28pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/5 "2026-10-23T21:28:59Z")

</div>

I am getting this today when running the install/upgrade script. Any ideas?

```auto
Upgrading to Nextcloud version 21.0.7

sha1sum: WARNING: 1 computed checksum did NOT match

------------------------------------------------------------

Download of https://github.com/nextcloud-releases/contacts/releases/download/v4.0.7/contacts-v4.0.7.tar.gz did not match expected checksum.

Found:

8ab31d205408e4f12067d8a4daa3595d46b513e3 /tmp/contacts.tgz

Expected:

45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 /tmp/contacts.tgz

```

---

<div class="post-metadata">

**Author:** ![david.blythe](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/david.blythe/32/3143_2.png) [@david.blythe](https://discourse.mailinabox.email/u/david.blythe)\
**Post date:** [October 23, 2026, 9:33pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/7 "2026-10-23T21:33:28Z")

</div>

What version of miab are you currently running, and what version of Ubuntu?

---

<div class="post-metadata">

**Author:** ![bluetardis](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/bluetardis/32/2119_2.png) [@bluetardis](https://discourse.mailinabox.email/u/bluetardis)\
**Post date:** [October 23, 2026, 9:34pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/8 "2026-10-23T21:34:54Z")

</div>

It was the current version (v78) as it had only been migrated to this server last week.

Its Ubuntu 22.04.5 LTS with ESM enabled and fully patched up.

The status page reports:

```auto
Mail-in-a-Box is up to date. You are running version v78.

```

* * *

Other than the _failed_ install script - with a reboot it’s still passing mail and web mail interface is working. Don’t otherwise use the Nextcloud but it seems like something may have been upgraded at their end in the last few hours.

---

<div class="post-metadata">

**Author:** ![david.blythe](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/david.blythe/32/3143_2.png) [@david.blythe](https://discourse.mailinabox.email/u/david.blythe)\
**Post date:** [October 23, 2026, 9:42pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/9 "2026-10-23T21:42:42Z")

</div>

can you grab the Nextcloud version the system thinks you’re on?

`cat /home/user-data/owncloud/config.php`

JUST the ‘version’ value, near the end of the output. Do not paste anything. Visually confirm, and type the version.

edit: this assumes you have the default ${STORAGE\_ROOT} location. amend the command accordingly

`cat ${STORAGE_ROOT}/owncloud/config.php`

---

<div class="post-metadata">

**Author:** ![bluetardis](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/bluetardis/32/2119_2.png) [@bluetardis](https://discourse.mailinabox.email/u/bluetardis)\
**Post date:** [October 23, 2026, 9:48pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/10 "2026-10-23T21:48:35Z")

</div>

When you say “grab” what do you mean specifically? (apologies as not sure if you meant you wanted the version or an install as you where quite specific later but I am missing some caffeine…)

`'version' => '20.0.14.2',`

---

<div class="post-metadata">

**Author:** ![david.blythe](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/david.blythe/32/3143_2.png) [@david.blythe](https://discourse.mailinabox.email/u/david.blythe)\
**Post date:** [October 23, 2026, 9:58pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/11 "2026-10-23T21:58:45Z")

</div>

inside mailinabox/setup/nextcloud.sh It is trying to execute this code:

```
`if [[${CURRENT_NEXTCLOUD_VER} =~ ^20]]; then
	InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 d0284b68135777ec9ca713c307216165b294d0fe
	CURRENT_NEXTCLOUD_VER="21.0.7"
fi`

```

if you update the 2nd hash with the hash from the output ( `8ab31d205408e4f12067d8a4daa3595d46b513e3` ), and then rerun, it should continue.

For some reason, the hash switched from 8ab31d205408e4f12067d8a4daa3595d46b513e3 to the current code.

---

<div class="post-metadata">

**Author:** ![david.blythe](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/david.blythe/32/3143_2.png) [@david.blythe](https://discourse.mailinabox.email/u/david.blythe)\
**Post date:** [October 23, 2026, 10:00pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/12 "2026-10-23T22:00:55Z")

</div>

offending commit where the hash was changed:

[Setup fixes for Ubuntu 22.04 · mail-in-a-box/mailinabox@91fc74b](https://github.com/mail-in-a-box/mailinabox/commit/91fc74b40899eaccf7433ed05967041baa28d9ff)

---

<div class="post-metadata">

**Author:** ![bluetardis](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/bluetardis/32/2119_2.png) [@bluetardis](https://discourse.mailinabox.email/u/bluetardis)\
**Post date:** [October 23, 2026, 10:58pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/13 "2026-10-23T22:58:20Z")

</div>

Hi David, truly appreciate the help but still somewhat stymied. Teach me to try and upgrade on a Saturday morning…

From console:

```auto
Upgrading Nextcloud --- backing up existing installation, configuration, and database to directory to /home/user-data/owncloud-backup/2026-10-24-09:50:30...

Upgrading to Nextcloud version 21.0.7

sha1sum: WARNING: 1 computed checksum did NOT match

------------------------------------------------------------

Download of https://github.com/nextcloud-releases/contacts/releases/download/v4.0.7/contacts-v4.0.7.tar.gz did not match expected checksum.

Found:

8ab31d205408e4f12067d8a4daa3595d46b513e3 /tmp/contacts.tgz

Expected:

45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 /tmp/contacts.tgz

```

The Current mailinabox/setup/nextcloud.sh:

```auto
                if [[${CURRENT_NEXTCLOUD_VER} =~ ^20]]; then

                        InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 8ab31d205408e4f12067d8a4daa3595d46b513e3 3.0.4 d0284b68135777ec9ca713c307216165b294d0fe 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

# InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 6fb1e998d307c53245faf1c37a96eb982bbee8ba 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

                        CURRENT_NEXTCLOUD_VER="21.0.7"

                fi

```

Any thoughts as to what to try next? (Neither the original or commented line versions work)

---

<div class="post-metadata">

**Author:** ![david.blythe](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/david.blythe/32/3143_2.png) [@david.blythe](https://discourse.mailinabox.email/u/david.blythe)\
**Post date:** [October 23, 2026, 11:38pm UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/14 "2026-10-23T23:38:52Z")

</div>

```auto
cp /mailinabox/setup/nextcloud.sh /mailinabox/setup/nextcloud.sh.bak

nano /mailinabox/setup/nextcloud.sh

```

completely delete the old line, so that only the new line remains (with the updated hash):

```auto
# InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 45e7cf4bfe99cd8d03625cf9e5a1bb2e90549136 3.0.4 6fb1e998d307c53245faf1c37a96eb982bbee8ba 1.0.0 3bf2609061d7214e7f0f69dd8883e55c4ec8f50a

```

Save & Exit

Remove the downloaded package (confirm it is there with ls):

```auto
cd /tmp/
ls
rm ./contacts.tgz

```

Run the script again:

```auto
cd ~/mailinabox
./setup/start.sh

```

If this doesn’t resolve the issue, start a new topic for further troubleshooting. I’ll do my best to provide as much support as possible.

---

<div class="post-metadata">

**Author:** ![bluetardis](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/bluetardis/32/2119_2.png) [@bluetardis](https://discourse.mailinabox.email/u/bluetardis)\
**Post date:** [October 24, 2026, 6:42am UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/15 "2026-10-24T06:42:13Z")

</div>

I have started a [new topic](https://discourse.mailinabox.email/t/next-cloud-setup-failing-github/17094) as there is something else going on but to confirm learnings:

1. Edit “sudo nano ./setup/nextcloud.sh” and dont comment out lines you actually need to replace it for some reason.
2. The amended line with all hashes that work is below.

`InstallNextcloud 21.0.7 f5c7079c5b56ce1e301c6a27c0d975d608bb01c9 4.0.7 8ab31d205408e4f12067d8a4daa3595d46b513e3 3.0.4 6fb1e998d307c53245faf1c37a96eb>`

1. Make sure you run the setup locally rather than downloading again (which will overwrite your changes)

`:` **`~/mailinabox`** `$ sudo ./setup/start.sh`

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [October 30, 2026, 6:42am UTC](https://discourse.mailinabox.email/t/security-update-version-78-posted-php-security-vulnerability/17082/16 "2026-10-30T06:42:49Z")

</div>

This topic was automatically closed 6 days after the last reply. New replies are no longer allowed.