We have released an updated Passwork Docker image with patched PHP (CVE-2026-109618 and CVE-2026-109619). If you run Passwork 7 or later in Docker, update today.
Warning: critical PHP vulnerabilities. CVE-2026-109618 and CVE-2026-109619 can allow an unauthenticated attacker to run code on a server that runs PHP, PHP-FPM included. Both score 9.2 on CVSS v4.0, and the PHP project says updating is the only complete fix. On-premise Passwork administrators...
For the third consecutive quarter, Passwork has earned SourceForge's Top Performer badge — this time for Fall 2026. Here's what verified reviewers are saying, and the numbers behind the award.
NIST says never rotate. PCI DSS can still say every 90 days. This guide maps nine frameworks and passkeys to vault controls and shows how to resolve the conflict by scope.
A KeePass export is a plaintext file waiting to leak. Here's how to move every credential into Passwork, prove the migration actually worked with a 6-control acceptance test, and retire the old vault without losing anything.
Pegnitz, a Bavarian town near Nuremberg, ran municipal IT on a file-based vault that couldn't handle concurrent access, forcing administrators to coordinate every edit verbally. The team moved to Passwork's self-hosted platform for real-time, multi-user credential access.
Auerbach in der Oberpfalz, a Bavarian town of 9,470 residents, ran municipal IT on two file-based password managers prone to sync failures and with no role-based access control. The team moved to Passwork's zero-knowledge platform to close that security gap.
Every vendor says "AES-256, zero-knowledge." None of that tells you what one compromised key actually opens. We ran the question against Passwork, Bitwarden, Passbolt, 1Password and Keeper.
A vault in Frankfurt can still answer to a foreign court order, and an "EU hosted" label says nothing about where the backups are. Use the six-zone map to find every place your credentials live, the GDPR duty each one triggers, and the evidence to hold before an audit.
A graduating student, an adjunct whose term ended, and a resigning employee are three different events, yet most identity tools treat them as one "leaver" case. Build separate access lifecycles, join them in one identity record, and remove only the access that is no longer justified.
