Remote profile

For users of the LinuxServer.io BookStack container image (and other LinuxServer provided PHP-based apps):

They are aware of the required patching, and are waiting on the packages to land upstream in Alpine (who are also working hard).

Please don't bug them. Updated container images will be made available as soon as possible.

Many environments have now received fixes for the critical PHP issues.

We've been tracking progress, and have BookStack specific guidance for updating, within our blogpost for this event:

https://www.bookstackapp.com/blog/php-security-release-critical/

There's now a BookStack blog for this, which we'll aim to keep updated with BookStack specific guidance as things develop:

https://www.bookstackapp.com/blog/php-security-release-critical/

❗ BookStack runs on PHP. Some Critical PHP vulnerabilities have been announced.

If your BookStack instance (even just the login page) is accessible on the open internet, or accessible to un-trusted users, it may be best to prevent access or turn off those systems until patches to PHP can be applied in your environment.

BookStack v26.09.2 is now available.

This is a security release to address a couple of vulnerabilities related to access permissions of comments and attachments.
It also includes a range of security improvements.

https://www.bookstackapp.com/blog/bookstack-release-v26-09-2/