Following the disclosure of two critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we've updated the Team Password Manager Docker image and made it available on our website and Docker Hub.
This update includes PHP 8.4.27, which addresses both vulnerabilities. The new Docker image version is 15.200.312_2.
If you're running Team Password Manager using Docker, we strongly recommend updating to the latest image as soon as possible.
Update on the vulnerabilities
Note: See the blog post with an update of the vulnerabilities
The PHP development team has announced two critical security vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.
Both vulnerabilities have been assigned a CVSS v4.0 severity score of 9.2 (Critical). According to preliminary reports from security researchers, they could potentially allow remote code execution (RCE) on affected servers.
An emergency PHP security release is scheduled for October 21, 2026, at 14:00 UTC.
What is known so far?
We're happy to announce the release of Team Password Manager v. 15.200.312, now available for download and upgrade.
This version is mostly about LDAP Sync, along with some improvements to custom fields and SAML.
LDAP Sync: two new object types
LDAP Sync now has six types of objects instead of four. Two are new in this version:
We're happy to announce the release of Team Password Manager v. 15.194.309, now available for download and upgrade.
Dark Mode
This new version features a recurring request over the years: dark mode!
Just a short note to tell you that we've updated the Firefox extension to v. 6.42.28 to match the features of the Chrome/Edge extensions.
Blog post explaining the recent changes to the browser extensions
More information on the browser extensions
We're happy to announce the release of Team Password Manager v. 14.190.309, now available for download and upgrade.
This new version features passkey authentication for local users.
With passkey authentication, users can sign in using passkeys previoulsy created and stored on supported devices or USB security keys (for example, Yubikey), providing a faster, passwordless sign in experience while maintaining strong security. Traditional username and password authentication continues to be fully supported.
We've updated the Docker image for v. 14.184.308 to update some of its components, specially Apache to the 2.4.67 version. This version corrects CVE-2026-23918, that affected Apache 2.4.66, which was the one in the previous Docker image. We've tagged this new image 14.184.308_2, and the latest tag (teampasswordmanager/teampasswordmanager:latest) also contains it.
Today we're releasing a new version of the Chrome/Edge extension, v. 6.42.27. The Firefox extension will follow in the near future has also been released. At the same time, we're also releasing a new version of Team Password Manager, v. 14.184.308.
Let me explain what we've included in these new versions:
Chrome Extension v. 6.42.27
This is a major rewrite of the extension. Here are the main changes:
We've updated the Docker image for v. 14.177.303 to update some of its components, specially Apache. We've tagged this new image 14.177.303_2, and the latest tag (teampasswordmanager/teampasswordmanager:latest) also contains it.
After the release of Google Chrome 142, some users have reported that the browser extension no longer connects to their Team Password Manager installation, even though the website itself still works normally.
Note that this only happens with Team Password Manager installations in local/private networks. Installations in public domains are not affected.
If this happened to you, here’s what’s going on and how to fix it.
