openITCOCKPIT version 5.9.0 has been released!

PHP vulnerabilities

As mentioned in the PHP security advisories, there are critical vulnerabilities that need to be addressed immediately.

• CVE-2026-109618.
• CVE-2026-109619.

Patches are available for Ubuntu, Debian and RHEL. Please make sure to install the latest security updates as soon as possible.

Show actual duration of Downtimes

Downtimes in openITCOCKPIT start and end at specific times, and have a fixed duration. How ever, a user may cancel a downtime, or it may start later than scheduled, for example if a user schedule a downtime with a start date in the past, or in case the monitoring engine is not running at the scheduled start time. While openITCOCKPIT tracks the schedule time and the actual time for a long time already, it never displayed the values to the user.

With this release, openITCOCKPIT will also show the actual start time, end time and the actual duration, in case it differs from the scheduled times.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in PHP and should be addressed immediately by updating to the latest PHP version. Large parts of openITCOCKPIT are build using PHP, especially on the main server and satellite systems. Due to the two vulnerabilities are in the programming language itself, please see the official PHP security advisories for more information:

The official openITCOCKPIT Android App has been released and is now available for download on Google Play.

📲 Please feel free to give it a shot using our demo server: https://demo.openitcockpit.io/

For more information on how to use the app, please see: https://docs.openitcockpit.io/en/additional/mobile-app/

Your openITCOCKPIT Team

openITCOCKPIT version 5.8.0 has been released!

Security fixes

This release includes important security fixes addressing Container Permission logic issues. An attacker could send malicious container configurations, which would required to restore the container tree from a backup.

WebSocket Event Stream

openITCOCKPIT 5.8.0 now provides a WebSocket Event Stream, allowing real-time access to monitoring events and notifications. This can be particularly useful for automation purposes and is a convenient way to process monitoring events with external tools like Node-RED. Please see the documentation for more details.

openITCOCKPIT version 5.7.0 has been released! Packed with new features, such as grouping for Statuspages, a new host dependency tree, a new WebSocket backend, security updates and much more.

Security fixes

We discovered and fixed several security vulnerabilities. An attacker was able to assign it’s account to another user group which could grant themselves elevated privileges. This affected the Master System and the Satellite Systems. In addition, we improved our Cookie handling. openITCOCKPIT will not enforce SameSite=Lax for cookies.

Dropped Support for Ubuntu 22.04, Debian 12 and PHP < 8.3

As mentioned in our last blog post we had to drop support for Ubuntu Jammy 22.04, Debian Bookworm 12 and PHP 8.1, PHP 8.2 in this release. This step is necessary as PHP 8.1 does not get security updates for more than 8 months by the time of writing this blog post. Unfortunately, this means that continuing to support Ubuntu 22.04 until its end of life in April 2027 would hold back the development of openITCOCKPIT for all users.

openITCOCKPIT 5.7.0 requires at least PHP 8.3.

Please see our official upgrade instructions if you are still using an older release.

• Update Ubuntu Jammy (22.04) to Ubuntu Noble (24.04)
• Upgrade from Debian Bookworm (12) to Debian Trixie (13)

Please notice: Changing the PHP version through a third-party repository is not supported and will break the system.

In case you are using Enterprise Linux (RHEL, AlmaLinux, Rocky Linux), please see our instructions:

• Updating PHP (Enterprise Linux only)