After the big release of version 1.5 in June, the third quarter of 2026 was all about stability and security. Six releases, several security fixes, new Alpine Docker images, and further growth in adoption: today we give you a comprehensive overview of everything that happened around mosparo and the mosparo Association between July and September 2026.

Six Releases in the Third Quarter

Between July 11 and September 28, 2026, we released versions 1.5.4 through 1.5.9. Here is the overview:

  • v1.5.4 (July 11): Bug fix for the update process and adjusted logging configuration
  • v1.5.5 (August 5): Security release for API authentication
  • v1.5.6 (September 17): Maintenance release with updated dependencies and new Khmer translations
  • v1.5.7 (September 24): Security release fixing two vulnerabilities
  • v1.5.8 (September 28): Security release with multiple security and logic fixes, plus new Alpine Docker images
  • v1.5.9 (September 28): Bugfix release for v1.5.8

Security: What Was Fixed

Three of the six releases were security releases. It is important to us that you learn transparently what happened and what it means for your installation.

v1.5.5: Timing Attack in API Authentication

The backend API endpoints (verifying submissions, statistics, rule packages) compared hashes using a simple string comparison. In theory, this would have made it possible to guess the private API key by measuring response times. The risk was manageable: an attacker would have needed thousands of requests and favorable network conditions. We switched to PHP’s dedicated hash_equals function. The issue was reported by senti-man via GitHub Security Advisories.

v1.5.7: API Debug Mode and Privilege Escalation

Two vulnerabilities, reported by 5afagy:

  • With the API debug mode enabled, the information it returned could be abused to create a valid API authorization. The debug mode now masks sensitive values, shows an additional warning, and marks affected projects in the project list with an exclamation icon.
  • Project members with the “Reader” role could view and modify submission rules and field rules. The permissions have been adjusted.

In addition, the form signature is now verified as part of the verification process. Important: In both cases, no form or user data could be requested.

v1.5.8: Internal Review and Further Fixes

After v1.5.7, we conducted another thorough internal review and found and fixed further issues. These include missing routes in the permission system (for example, for the advanced project settings, translations, project members, and project groups), an unprotected setup route, stricter key validation for the web cron job, and adjustments to the import and design mode switching. We also fixed a logic issue in silent mode that invalidated the results of the honeypot and Proof-of-Work features.

Most of these fixes only affect installations with project members in the Editor or Reader roles or with the web cron job enabled. If you cannot update right away, you can block access to /setup/* as an interim measure.

What Changes in Version 1.6

We have identified better solutions for the future: the permission system will switch to “deny by default”, so new routes are blocked for readers by default. The API debug mode will be removed and replaced by an API response history in the administration area.

Our clear recommendation: update to the latest version. By the way, you can automatically monitor the current version number at updates.mosparo.io/v/stable.txt.

New: Alpine-Based Docker Images

With v1.5.8, new Docker images based on Alpine are available. They have a much smaller footprint, which means smaller downloads and fewer potential security issues. If you run mosparo with Docker, we recommend using the Alpine images from now on. Switching should be possible without any problems.

A big thank you goes to uluzox, who contributed the changes as a pull request. We really appreciate such active involvement.

Shortly After Quarter End: v1.5.10, v1.5.11, and v1.5.12

Version 1.5.10 was released on October 4, 2026; version 1.5.11 on October 10; and version 1.5.12 on October 19. These releases include numerous bug fixes related to the calculation of lockout periods, the proof-of-work mechanism, the counting of spam submissions in silent mode, and field rules, and also improve the Docker images. Hardening measures have also been expanded: Project members can no longer be added to the same project multiple times, and users can no longer delete their own accounts. Furthermore, the import and export commands, which had not yet been updated to version 1.5, have been corrected, and additional optimizations have been implemented throughout mosparo. Version 1.5.12 fixes an issue introduced in version 1.5.10 that prevented users from being created.

After the updates, mosparo must recalculate prepared values and hashes. To do this, open the web interface after the updates have been applied and wait until the process is complete.

Thanks to the Community

Many improvements this quarter go back to feedback from the community: thank you to everyone who reported bugs, among others on the update process (#432), logging (#435), and form validation (#450), and to everyone who contributes translations. We are especially grateful for the responsible reporting of security issues through the proper channels.

The Detection Rate: Honest Instead of Marketing

In August, we published the article “The detection rate”. The key message: no spam protection method achieves 100% effectiveness over a long period. mosparo deliberately starts at 0 percent because no rules exist yet. As soon as you see the first undetected spam submission, you create a rule, for example for a keyword, an IP address, or an AS number. That spam source will no longer get through.

How well this works in practice is shown by an example project from the community: in one month, 8,312 spam submissions and 71 valid submissions were processed. With just three rules (AS numbers, IP addresses, and the new submission rule for random values), the detection rate exceeded 95 percent after a few days. Maintaining the rules typically takes around 15 minutes, once a day or once a week, without puzzles, tracking, or unnecessary data collection.

With version 1.6, this will become even easier: values can be added to field rules more conveniently, and new field rules can be created directly from the submission view.

Adoption and Usage in Numbers (With Due Caution)

As emphasized in our previous reports, the following figures should be interpreted with caution. They come from an external, publicly available analysis and are subject to constant change.

As of October 7, 2026, the picture looks as follows (Q2 figures in brackets):

  • 955,578 websites contain the word “mosparo” (Q2: 876,518)
  • 628,357 websites have an actual mosparo integration (Q2: 396,563)
  • 2,313 domains (including subdomains) actively use mosparo (Q2: 1,839)
  • 3,042 domains contain the word “mosparo” (Q2: 2,447)

Particularly pleasing: the number of domains with an active integration grew by roughly a quarter within a single quarter. Regarding the strong increase in websites with an integration, please note that in Q2 around 250,000 newly added websites had not yet been fully evaluated. Even with appropriate caution, one thing holds: mosparo keeps growing, and significantly so.

Outlook for Version 1.6

Planning for the next major version is underway. Version 1.6 is expected to include, among other things:

  • Raising the minimum PHP version from 8.1.10 to 8.2.0
  • Upgrade to Symfony 7.4 and an update of all backend and frontend dependencies.
  • New sign-in methods: OpenID Connect (OIDC) and passkeys, as part of an expansion of authentication
  • Combined rules: multiple rules can be merged into a single, individually weighted rule
  • Easier rule maintenance: add values to field rules faster and create field rules directly from the submission view
  • A new permission system following the “deny by default” principle and an API response history replacing the API debug mode
  • A toolbar for submission values in the detail view
  • Possibly further features that may be added as development progresses.

You can follow all planned items on GitHub in the v1.6 milestone. We will, of course, keep you updated on further progress.

Community and Association

We are continuing to work on raising awareness of mosparo and, with it, the mosparo Association.

Would you like to support the development of mosparo? Become a member of the mosparo Association or support the project with a donation.

Conclusion

The third quarter of 2026 was a quarter of care: three security releases, numerous bug fixes, new Alpine Docker images, and an honest look at the detection rate. At the same time, the adoption of mosparo keeps growing, with more than 2,300 domains with an active integration. With version 1.6, the next big milestone is already on the horizon.

Do you have a success story with mosparo or ideas on how we can improve it? Write to us at contact@mosparo-association.org or share your feedback in the GitHub Discussions.