Security - Update ASAP
- PHP 8.5.12 in the Docker image. PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619, two critical bugs that allow unauthenticated remote code execution on any PHP web server (php.net advisory, 21 October 2026). The image moves from PHP 8.4 to 8.5, and its build now fails on any older PHP base instead of shipping it. Docker users: pull this release. Manual installs: update PHP to 8.5.12, 8.4.27 or 8.3.36 or later through your package manager, then restart php-fpm.
Fixes
- Signed-in phones are no longer refused in approved-only mode. Phones never send their device details, so the console never created a device for them, and the server refused every session they started even with the user signed in. Signing in to the client, with a password or SSO, now registers the device when the console has not seen it: pending if new devices need approval, in the default group, owned by the user who signed in. Approve on sign-in applies, and now also applies to SSO sign-ins. (#110)
- The console log's action filter lists every recorded action, grouped by area. About 30 were missing, backups among them. Picking an action now matches only that action: "Invitation sent" no longer also returns resends and revokes. (#108)
- Device scope applies to offline and recovery alerts only. A device pending approval has just appeared, so no device list can name it, and the scope option for that event did nothing useful. It is gone, and a scope saved for it earlier is ignored. Offline and recovery now sit side by side in Settings → Notifications. (#109)
Notes
- No database migrations in this release.
- Signed-in phones now appear in the device list, shown by their RustDesk ID and as offline. A phone that later reports in fills in its own details.
- Wiki: Server Access Control, Notifications, Install on a VM.
docker pull marcpope/cortendesk:1.15.0
docker pull ghcr.io/marcpope/cortendesk:1.15.0