No public statement located for Roundcube as of 24 October 2026, 11:21 UTC; places checked: https://roundcube.net/news/ (newest: Security updates 1.6.20 and 1.7.5 released 19 October 2026, pre-dating PHP2Shell, nothing on PHP2Shell); https://github.com/roundcube/roundcubemail/releases (snapshot newest 1.7.4, 6 Sep, nothing on PHP2Shell); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Roundcube Webmail listed Vulnerable; Roundcube Docker image family listed Vulnerable, unrebuilt variants).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Roundcube Docker image family listed Vulnerable, unrebuilt variants)
Last checked
The statement
No public statement located as of at: https://roundcube.net/news/ (newest: Security updates 1.6.20 and 1.7.5 released 19 October 2026, pre-dating PHP2Shell, nothing on PHP2Shell); https://github.com/roundcube/roundcubemail/releases (snapshot newest 1.7.4, 6 Sep, nothing on PHP2Shell); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Roundcube Webmail listed Vulnerable; Roundcube Docker image family listed Vulnerable, unrebuilt variants).
Notes
No Roundcube statement on PHP2Shell found in the project news or release notes as of the last check. NCSC-NL inventory lists Roundcube Webmail and its Docker image family as Vulnerable on the basis of PHP requirements and unrebuilt images, not a project statement.
Change log
: first check
: Source-only recheck completed; published classification unchanged.
: Source-only recheck completed; published classification unchanged.
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
A badge is issued once a public statement is located and verified on the company's own domain or verified official account.
Questions about Roundcube and PHP2Shell
Is Roundcube affected by PHP2Shell?
No public statement located for Roundcube as of 24 October 2026, 11:21 UTC; places checked: https://roundcube.net/news/ (newest: Security updates 1.6.20 and 1.7.5 released 19 October 2026, pre-dating PHP2Shell, nothing on PHP2Shell); https://github.com/roundcube/roundcubemail/releases (snapshot newest 1.7.4, 6 Sep, nothing on PHP2Shell); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Roundcube Webmail listed Vulnerable; Roundcube Docker image family listed Vulnerable, unrebuilt variants).
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.