osTicket Awesome Security Patch, November 2026

Who needs it: every installation from 1.12-Awesome-102 through 1.18.4-Awesome-102.
It is free. No license or login is required.

Full instructions: https://osawesome.com/documentation/security-patch-2026-11/

1. Back up your osTicket folder and database.
2. Extract this ZIP.
3. Copy the "osta" folder over the "osta" folder in your osTicket folder, and
   let it replace existing files. Four files are replaced or added inside
   osta/, and no other osTicket file is touched. One of them is named
   .htaccess, which some programs hide, so check that it was copied.
4. Log in as an administrator, open your theme settings page (scp/theme.php),
   and click Save Changes once. This cleans stored settings an attacker changed.

On nginx, or if your Apache does not read .htaccess files, you must also add
the server rules, because the included .htaccess file has no effect there:
https://osawesome.com/documentation/security-patch-2026-11/server-rules/

This patch closes the hole. It does not remove anything an attacker already
added. The instructions page explains how to check.
