iRedMail — iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

null@example.com (venzonic) — Fri, 23 Oct 2026 01:13:48 +0000

ZhangHuangbin wrote:

Just run "apt update && apt upgrade" on Ubuntu machine to update php packages, newer php packages fix the issue.

Please confirm if executing this update will not cause any system issues.

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

null@example.com (ZhangHuangbin) — Thu, 22 Oct 2026 14:14:31 +0000

Just run "apt update && apt upgrade" on Ubuntu machine to update php packages, newer php packages fix the issue.

Re: iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

null@example.com (CP) — Thu, 22 Oct 2026 13:51:34 +0000

UPDATE:
I checked:
https://ubuntu.com/security/CVE-2026-109618
https://ubuntu.com/security/CVE-2026-109619
and php8.1 in 22.04 LTS jammy has status "Fixed in 8.1.2-1ubuntu2.28" (backporting?).

After, I checked my installation with:
dpkg -l | grep php8.1-cli
and it reports:
ii php8.1-cli 8.1.2-1ubuntu2.28 amd64 command-line interpreter for the PHP scripting language

so I think I'm ok for now.

Hope this is useful to anyone in the same guessing situation.

If I'm wrong, please let me know.
CP

iRedMail EE on Ubuntu 22.04 and php 8.1 (vulnerable?)

null@example.com (CP) — Thu, 22 Oct 2026 13:21:19 +0000

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): iRedMail EE v1.8.5
- Deployed with iRedMail Easy or the downloadable installer? iRedMail EE deployment
- Linux/BSD distribution name and version: Ubuntu 22.04.5 LTS
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? n/a
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hello. Following Critical PHP vulnerabilities announcement , I checked php version on my iRedMail EE installation on Ubuntu 22.04.5 LTS and found RoundCube uses php 8.1 (the default version for v22.04).

Is anyone in the same situation. Any suggestion how address this?

I was thinking to add the 8.3 repository, installing it and changing iRedMail configuration so that 8.3 is used instead of 8.1; but I have no idea if this could interfere with RedMail EE auto deployment.

Long term plan could be creating a new server with Ubuntu 26.04 and migrate mailboxes, but in the meantime? In-place upgrade is out of question.

As of now I closed access to Roundcube from external, to prevent exploiting php vulnerability.

Ideas welcomed.
CP