KeyHelp^® 26.2 – Important security update and support for Ubuntu 26.04

• Important security update – updating is highly recommended
  Version 26.2 contains important security fixes. Among other things, it fixes a vulnerability that, under certain circumstances, allowed user authentication to be bypassed.
  
  The vulnerability was discovered by the team at CODE WHITE (https://code-white.com/), who responsibly reported it to us. Without their report, the vulnerability might have gone undetected for much longer. We would like to express our sincere thanks to them.
  
  If your system has not yet been updated to KeyHelp 26.2, we strongly recommend updating as soon as possible.
  
  Please also note that systems whose operating system has reached end-of-life status generally no longer receive updates. If you are running such a system, you should switch to a current operating system version as soon as possible. This is all the more important given the “php2shell” vulnerability that became public in recent days: since these systems also no longer receive updated PHP interpreters, they will remain permanently vulnerable to this flaw as well as to the vulnerability described above.

• Support for Ubuntu 26.04
  As of version 26.2, KeyHelp supports Ubuntu 26.04 “Resolute Raccoon”. The new Ubuntu release brings updated system libraries, newer software versions, and long-term security updates. This provides a modern, future-proof foundation for new server installations.
  
  Existing installations can be migrated from Ubuntu 24.04 to Ubuntu 26.04 at a later date. As usual, we will provide an upgrade script and step-by-step instructions to make the transition as smooth and safe as possible. The script will be released in the coming weeks and will also be announced here.
  
  Please never perform a distribution upgrade manually. Only use the scripts provided at https://www.keyhelp.de/help.
  
  Although support for Ubuntu 26.04 has been extensively tested, unexpected issues may still occur in this first release. Please take this into account when planning production environments.

• Automatic patch installation
  KeyHelp has long offered the option to install smaller patches between regular KeyHelp updates. With the new version, this process can now be automated. By default, KeyHelp regularly checks whether new patches are available and installs them automatically as needed. In addition, the patch system has been extended with further features that keep any follow-up work required from administrators to a minimum.
  
  You can find the settings for automatic patch installation in the KeyHelp admin area under “Maintenance tasks”.

• Webmail: Tachyon replaces SnappyMail
  The webmail application SnappyMail (an indirect successor to RainLoop) has not received any updates for quite some time and can therefore no longer be considered safe to run. However, Tachyon is available as a drop-in replacement that fully matches SnappyMail in look and feel.
  
  Servers that previously used SnappyMail will be switched to Tachyon automatically as part of the update. Servers running Ubuntu 22.04 are an exception: Tachyon is not available there, so these servers will be switched to Roundcube automatically instead. If you prefer the look and feel of SnappyMail, we recommend upgrading your operating system. On newer Ubuntu versions, you can use Tachyon as a direct replacement for SnappyMail.

A full overview of all changes will be available in the changelog at https://changelog.keyhelp.de in the next few days.