Repository navigation
鈿狅笍 Security release
This release upgrades the bundled PHP version to 8.4.27, which fixes two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Either vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server.
If you self-host Hyvor Relay, please upgrade to this version as soon as possible. There are no other functional changes in this release.
For details on the vulnerabilities and how we responded, see our incident report and PHP's security advisory.
Full Changelog: 0.0.46...0.0.48