So that confirms that the issue is the "UPDATE 1" that the mail server is sending Roundcube. Looking at the script your running I think the "UPDATE 1" is the output of the psql command, try adding --quiet to that command to suppress the output if that doesn't work try piping the output to /dev/null

Quote from: SKaero on February 17, 2026, 12:29:55 AMI don't think my request was clear, I would like to see the log from a working login and and failed login. Looking at what was posted I don't know what the "UPDATE 1" is there for and my guess is that is what is causing the issue but I would like to confirm with a comparison to a successful login.

ok. log for succesfull login
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * OK [CAPABILITY IMAP4rev1 LO
GIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=DIGEST
-MD5 AUTH=CRAM-MD5 AUTH=SCRAM-SHA-1 AUTH=SCRAM-SHA-256] Dovecot ready.
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0001 AUTHENTICATE CRAM-MD5
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: + PDY4NzA5NTI1Mjc5MDc4NjcuMTc
3MTMwNzU2NUBzb2xvPg==
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: ****** [58]
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0001 OK [CAPABILITY IMAP4rev
1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THR
EAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDRE
N NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SE
ARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREV
IEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS N
OTIFY LITERAL+] Logged in
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0002 ID ("name" "Roundcube"
"version" "1.6.13" "php" "8.3.6" "os" "Linux" "command" "/roundcube/?_task=login
")
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * ID ("name" "Dovecot")
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0002 OK ID completed (0.001
+ 0.000 secs).
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0003 NAMESPACE
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: * NAMESPACE (("" "/")) NIL NI
L
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] S: A0003 OK Namespace completed
(0.001 + 0.000 secs).
[17-Feb-2026 05:52:45 +0000]: <dge1q0i3> [E621] C: A0004 LIST (SPECIAL-USE) "" "
*" RETURN (SUBSCRIBED)
.....

in dovecot config disabled this:
service imap {
#  executable = imap imap-postlogin
}


I don't think my request was clear, I would like to see the log from a working login and and failed login. Looking at what was posted I don't know what the "UPDATE 1" is there for and my guess is that is what is causing the issue but I would like to confirm with a comparison to a successful login.

Quote from: SKaero on February 16, 2026, 09:43:57 AMEnable imap_debug in the Roundcube config and then look at the log to see what the mail server is returning to Roundcube.

Look first code in my message.

Enable imap_debug in the Roundcube config and then look at the log to see what the mail server is returning to Roundcube.

Use: roundcube 1.6.13 + php 8.3.6, Dovecot 2.4.2. Users authenticated use CRAM-MD5 encrypted passwords. (for plain passwords - all ok). dovecot running script after succesfull user login, roundcube cann't login. if disable postlogin procedure in dovecot - roundcube sucessfull logon.

Imap debug:
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: * OK [CAPABILITY IMAP4rev1 LO
GIN-REFERRALS ID ENABLE IDLE SASL-IR LITERAL+ STARTTLS LOGINDISABLED AUTH=DIGEST
-MD5 AUTH=CRAM-MD5 AUTH=SCRAM-SHA-1 AUTH=SCRAM-SHA-256] Dovecot ready.
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] C: A0001 AUTHENTICATE CRAM-MD5
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: + PDcxNzgxNzEyODgwNzUzNDIuMTc
3MTIzOTU1MEBzb2xvPg==
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] C: ****** [58]
[16-Feb-2026 10:59:10 +0000]: <sjjbdalv> [D991] S: UPDATE 1


Userlogins:
[16-Feb-2026 10:59:11 +0000]: <sjjbdalv> Failed login for ***@***.** from 10.5
.16.48 in session sjjbdalvqo2c3bal (error: -2)
Dovecot has no errors in logs

Dovecot config:
service imap {
  executable = imap imap-postlogin
}
service imap-postlogin {
    executable = script-login /etc/dovecot/scripts/lastlog
    user = $SET:default_internal_user
    unix_listener imap-postlogin {
        mode = 0660
        user = vmail
        group = vmail
    }
}

lastlogin script:
#!/bin/sh

DBUSER=dovecot
DBPASS=*****
HOST=*****
DB=mailserver

QUERY="update users set lastlogin=localtimestamp(0), remote_ip='$IP' where email='$USER'"

psql postgresql://$DBUSER:$DBPASS@$HOST/$DB --command="$QUERY"

exec "$@"

Thuderbird worked correctly without errors.

Please help.

We just published the fourth release candidate for the next major version 1.7 of Roundcube webmail.

This release fixes two minor issues, it's mostly published to fix a file permission problem in the previous release v1.7-rc3.

The changes are:

• Ensure correct file permissions when building a release.
• Installer: Fix broken link to download the created configuration file (#10092)

The tarballs can be downloaded from roundcube.net/download.

Or directly from the release page at github.com.

We believe it is production ready, but we recommend to test it on a separate environment.

Migrate existing configs with either the installto.sh or the update.sh scripts.

And don't forget to backup your data before installing it!

Source: https://roundcube.net/news/2026/02/13/roundcube-1.7-rc4-released
Get it Now: https://roundcube.net/download

Hi JohnDoh!

Quote from: JohnDoh on February 12, 2026, 09:00:13 AMsymfony/polyfill-php85

You were right, thanks for the hint! I had symfony/polyfill-php80 installed which might have worked until beta2 of Roundcube. The ReadMe of polyfill-php85 states the new functions array_first and array_last (amon others). I've upgraded it to symfony/polyfill-php85 and now it runs again.

I've seen many some to domains with Roundcube and others without, I do think they pickup domains that are on cPanel more often though since Roundcube is the default webmail for cPanel.

It was sent to info at my domain running RoundCube, which makes me think they might be scanning for instances.

Subject: Account Notice: Terms Update Required to Avoid Service Interruption
Date: Thu, 5 Feb 2026 20:31:12 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0B49_01DC96DE.5E1B0F10"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 16.4.3528.331
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3528.331

This is a multi-part message in MIME format.

------=_NextPart_000_0B49_01DC96DE.5E1B0F10
Content-Type: text/plain;
    charset="windows-1251"
Content-Transfer-Encoding: quoted-printable

Important Notice About Your Account
Dear user,
If you do not accept the updated terms and conditions before February, 7, access to your Roundcube mailbox and related email services may be automatically suspended. After that date you may no longer be able to:
Send or receive emails Access contacts, calendar, or stored files
Use connected email apps (mobile clients, IMAP/POP3, etc.)
The acceptance process usually takes less than a minute.
Review and Accept Terms This message was sent by the Roundcube administration team. To stop receiving policy notifications, update your email preferences.

It contains a link to rdnundcube.com.