v2.99.2

IMPORTANT UPDATE - UPDATE YOUR SERVERS

Security

• Docker image now runs PHP 8.4.27. It fixes two critical remote code execution bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). An unauthenticated attacker can reach them with a single web request, before any BBS code runs. The image build now refuses to use any PHP older than 8.4.27.
• Bare-metal installs use Ubuntu's PHP packages, so the fix comes from Ubuntu, not from this release. Ubuntu released patched packages on October 21 (USN-8948-1). Servers with unattended upgrades pick them up automatically. Otherwise, apply your system updates.

Fixes

• Create a backup plan from a template through the API (#544). POST /api/v1/clients/{id}/plans accepts template_id. The template fills in directories, excludes and advanced options, and any of those sent in the request override the template's value. Thanks to @pano9000.
• Stuck upgrade page (#545). If you ran an update by hand to get past a stuck upgrade page, the page said the upgrade failed because you'd ended up on a newer version than the target. A newer version now counts as success. The page also no longer thinks an upgrade is still running when its old process ID belongs to something else after a reboot. Thanks to @fleenerhouse for the report.