This update fixes several critical, high-severity security flaws recently discovered in third-party code PostalPoint relies on.
Update as soon as possible; until you do, an attacker can intercept data going to or from PostalPoint, and might be able to run malicious code on your computer.
Linux users: These vulnerabilities are also present in other programs on your computer, so a full system update is required.
Open a Terminal/Konsole window, type sudo apt update && sudo apt upgrade -y, press Enter,
type your computer login password if prompted, and press Enter again. After the Linux updates are installed, reboot your PC.
Patched vulnerabilities:
- CVE-2026-111497 a.k.a. Brotli2Shell
- CVE-2026-106069
- CVE-2026-106072
- CVE-2026-105482
- CVE-2026-105483
- CVE-2026-105481
- CVE-2026-106074
- CVE-2026-106070
- CVE-2026-106073
Other security fixes:
- Block eMudhra certificate authority
- Enable CRLSet emergency certificate revocation
Other updates and bug fixes:
- Fix bug pairing Square reader when Square account has multiple locations
- Fix bug where packaging recall button fills in inches when units set to cm
- Send origin phone and email address from Settings > Business when creating shipments
- Return some address autocomplete results from just a postal code
- Save register ID on transactions
- Add daily transaction summary by register report
- Plugins: Add shipping.addLegalDisclaimer plugin API to show extra text on rate screen
- Support scanning USPS Ground Advantage packaging barcodes