Roundcube began as a personal project in Switzerland, in July 2005: an IMAP webmail client in PHP that used real Ajax, not a CGI form. The first stable release came on 4 March 2008. Version 1.0, on 7 April 2014. On 10 May 2026 came 1.7. On 6 September 2026 — the day this text was published — the patches were released 1.7.4 and 1.6.19. It is the webmail cPanel put in place of SquirrelMail, that ISPConfig packages and that Nextcloud adopted in 2023.
A side project in 2005
Thomas Bruederli, a Swiss engineer, grew tired of the webmail of the time: formatted text, a reload on every click, a 1999 look. Browsers already supported XMLHttpRequest. He wanted an IMAP client that felt like an app — drag messages, autocomplete addresses while typing, real HTML — running on any LAMP stack.
On 17 June 2005 the site already showed alpha screenshots. On 21 July 2005 came the release of 0.1-alpha on SourceForge: “it is only development and probably quite buggy”. On 7 October, SQLite, PostgreSQL and the first translations (French, Italian, Spanish, Danish, Dutch). On 19 February 2006, 0.1-beta. Two years of nightlies. No corporate roadmap. “It happened naturally,” Thomas said in 2023, in the Nextcloud interview.
0.1-stable: 4 March 2008
The official announcement: after more than two years, the first version considered good for production. It was not yet the dream webmail — the text itself admits it. The TinyMCE HTML composer was enabled, but experimental. And it was the last release on PHP 4: the GoPHP5 project called for PHP 5, and Roundcube complied starting with 0.2.
On 9 June 2008, 0.2-alpha already brought DOM sanitization of HTML (message XSS haunts every webmail) and dropped PHP 4. On 30 December, 0.2-stable: upgrade script, some 80 bugs. From there the 0.x series moved along every year or two — 0.3 (Sep/2009), 0.4 (Aug/2010), 0.5 (Jan/2011) — until 0.9 in April 2013, with the Roundcube Framework already separated and PDO replacing PEAR:MDB2.
What the cube does
Boring architecture, on purpose. Apache/nginx + PHP. IMAP to read, SMTP to send. MySQL, PostgreSQL or SQLite for sessions, contacts and preferences. No mail server of its own: Roundcube is the face, not Postfix. XHTML/CSS interface, skins, plugins. GPL-3.0-or-later, with an exception for third-party skins and plugins.
Ajax was the message in 2005: the message list does not reload the entire page, addresses autocomplete, attachments upload by drag-and-drop (that came later, in 0.9). More than 70 languages. vCard, LDAP, shared folders with ACL, identities, PGP via Mailvelope, OAuth. In 2009 two core developers cited the University of Michigan with more than 70 thousand accounts — the largest deployment they knew of.
1.0, eight years later
In 7 April 2014 Thomas announced 1.0.0 on the list: “after more than eight years since the initial publication, we feel confident calling it one-dot-oh.” Configuration in a single file, message import, advanced LDAP, drafts in localStorage, canned replies, keyboard controls in the list, attachment reminder. The plugin repository was born. The beer in the announcement was literal.
cPanel — and with it HostGator, OVH, Gandi and a generation of hosting panels — adopted Roundcube in place of SquirrelMail. On Linux servers, the cube became the default webmail for those who did not want Horde or Zimbra. ISPConfig on Debian packages the same client; the course on email with Postfix is the foundation it stands on.
Roundcube Next: the crowdfunding project that never arrived
On 3 May 2015, Roundcube and Kolab Systems AG announced a rewrite: calendar, chat, files, WebRTC, Dropbox/ownCloud connectors. The campaign asked for US$ 80 thousand. On 24 June the goal was reached; the total was US$ 103.541. In 2016 development stopped. Backers got no updates, no refunds. Phoronix covered the delay in 2016 and the corpse in 2018. In a GitHub issue, a Roundcube developer said the project had no ownership of the Next campaign — despite the name and the page. Classic 1.x, PHP and IMAP, is what survived.
Aleksander Machniak (Alec), from Kolab, signs the 2026 releases. Thomas gradually faded out as his children were born: “time outside work shifted to the other side.”
Elastic, the cube in your pocket
Version 1.4.0 came out on 9 November 2019. After more than two years of work by Alec and volunteers, the skin Elastic — LESS, responsive, mobile — became the default. Email bounce, improved Mailvelope, Redis/Memcached, SMTPUTF8, GSSAPI. The announcement asked users to customize Elastic colors: webmail that looks like generic Gmail is an invitation to phishing.
Version 1.6.0 (28 July 2022) cleaned up the code and embraced PHP 8.1, dropping PHP earlier than 7.3. Support for 1.5.x ended. Version 1.6 became LTS when 1.7 was born.
Nextcloud, 29 November 2023
Thomas approached Frank Karlitschek. “It was the first name that came to mind.” Nextcloud became the steward: hiring people, a dedicated forum, the cube remains a separate product — it does not replace Nextcloud Mail or become a mandatory plugin. The ideology is the same: self-hosting, your own IMAP, no Gmail in between. Harvard, Cambridge and the European Commission appear in the Nextcloud announcement as users; the cube was already in hosting panels and Synology NAS devices long before the marriage.
1.7 and the price of HTML
Version 1.7.0 (10 May 2026) required PHP ≥ 8.1, killed Internet Explorer, SQL Server and Oracle, and made the document root mandatory at public_html/ — static assets go through static.php. Markdown in composition, advanced search, quick menu in the list, real OAuth2/OIDC (discovery, logout).
Webmail that renders HTML from strangers is an XSS surface. In 2023 the Winter Vivern group (TA473) exploited XSS in Roundcube against European governments: opening the email was enough. Russian APT28 used the same class against Ukrainian servers. In February 2026 CISA warned of active exploitation; the patches were 1.6.13 and 1.5.13. On 6 September 2026 came 1.6.19 and 1.7.4 (CSS smuggling, header injection, XSS in TNEF/editor). It is not marketing drama: it is the job. Anyone leaving 1.5.x online is out of support.
On Linux today
Debian/Ubuntu still package roundcube — it tends to lag behind upstream. The path for those who control the server is the tarball from roundcube.net/download or the official Docker image, pointing the virtual host to public_html/ in 1.7. Existing IMAP and SMTP (Dovecot + Postfix, the combo from ISPConfig). Separate database. Plugins only from the repository or the project’s GitHub — the graveyard of 2012 plugins is the other XSS.
# conferir o que o painel instalou
dpkg -l 'roundcube*' 2>/dev/null
# a série que ainda recebe patch em setembro de 2026: 1.6 LTS e 1.7
Upgrading: back up config/config.inc.php and the database, read the UPGRADING for the tag, do not jump to 1.7 without testing the new document root.
Wrap-up
A Swiss developer, a 2005 alpha, an isometric cube. The Next of 2015 never came. The 1.x came, Elastic came, Nextcloud came, the September 2026 patch came. The message has not changed: email remains IMAP on your machine, and the face in the browser can still be free software.
Site: roundcube.net · code: github.com/roundcube/roundcubemail · 1.7.4: releases/tag/1.7.4 · Thomas/Frank interview: Nextcloud, Nov/2023.