Original release notes
[!IMPORTANT] This release backports the v4.4.7 security fixes to this release line. It is the same security release as v4.4.7, not a separate one. It fixes multiple critical CVEs in dependencies that Coolify uses, so update immediately.
[!TIP] Run this on your server to update to the security fix release of your line: ```bash curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash | Running | Security fix release | |---|---| | v4.0.x | v4.0.1 | | v4.1.x | v4.1.3 | | v4.2.x | v4.2.1 | | v4.3.x | v4.3.24 | | v4.4.x | v4.4.7 | The script requires a stable release (not a beta, RC, or nightly). If you can, upgrade to v4.4.7 instead, because it also includes other security fixes that are not backported.
Security
- Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
- Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
- Updated Sentinel to 1.1.2 to fix CVE-2026-111943.
Issues
- fixes https://github.com/coollabsio/coolify/issues/12266
