❗ BookStack runs on PHP. Some Critical PHP vulnerabilities have been announced.
If your BookStack instance (even just the login page) is accessible on the open internet, or accessible to un-trusted users, it may be best to prevent access or turn off those systems until patches to PHP can be applied in your environment.
There's now a BookStack blog for this, which we'll aim to keep updated with BookStack specific guidance as things develop:
https://www.bookstackapp.com/blog/php-security-release-critical/
BookStackCritical PHP Security Release · BookStackNote: This page will be updated with additional guidance throughout the day as extra details & patches become available.
