v1.0.4-beeeta

Jun OS v1.0.4-beeeta

Security release. Please update.

Warning

This release is rushed out because of how severe the PHP bugs are (CVSS 9.2). The Android app got less testing than usual and might be buggy. If it misbehaves, open an issue, and the desktop install is the safe bet in the meantime.

What happened

Two bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619 (people are calling them PHP2Shell), let someone who can reach a PHP server run code on it without logging in. Jun OS's own code isn't the problem, the PHP running it is, and every older release ships an affected PHP.

Am I exposed?

• Default install: she only listens on your own computer (127.0.0.1), so the risk is low. Update anyway.
• BIND_ADDR set (phones and other devices on your network): anyone on that network could reach it. Update now.
• Reachable from the internet (the prod profile, port forwarding, a tunnel you set up yourself): update right now, and until you have, stop her.
• Android app: not affected, it has no PHP in it.
• Colab notebook: uses Ubuntu's PHP, fresh every run, and only you can reach it through Colab. Nothing to do.

How to update

• Windows: Update in the Jun OS app, or run the installer again. The update now also replaces the bundled PHP whenever a newer one is out (older versions kept the PHP they were installed with forever, which is the other half of this fix).
• Linux: run the install line again. The php container rebuilds on PHP 8.2.35.

Check it worked: docker exec omega-php php -v on Linux, JunOS\runtime\php\php.exe -v on Windows. You want 8.2.35 / 8.5.12 or newer.

Also in this release

• Android: a missing lore file no longer crashes every chat turn.
• Pinch zoom on touch screens.