diff --git a/towncrier/newsfragments/3347.bugfix b/towncrier/newsfragments/3347.bugfix
index cefcfd3e..c06c7515 100644
--- a/towncrier/newsfragments/3347.bugfix
+++ b/towncrier/newsfragments/3347.bugfix
@@ -1,3 +1,4 @@
 Update to a newer clamav 1.2.3-45
 Update to snappymail 2.36.4
+Update to roundcube 1.6.8 (CVE-2024-42009, CVE-2024-42008, CVE-2024-42010)
 Add a new DNS entry for autodiscover (old MUA autoconfiguration)
diff --git a/webmails/Dockerfile b/webmails/Dockerfile
index 4e33a4da..4e6e6896 100644
--- a/webmails/Dockerfile
+++ b/webmails/Dockerfile
@@ -28,7 +28,7 @@ RUN set -euxo pipefail \
   ; mkdir -p /run/nginx /conf
 
 # roundcube
-ENV ROUNDCUBE_URL https://github.com/roundcube/roundcubemail/releases/download/1.6.7/roundcubemail-1.6.7-complete.tar.gz
+ENV ROUNDCUBE_URL https://github.com/roundcube/roundcubemail/releases/download/1.6.8/roundcubemail-1.6.8-complete.tar.gz
 ENV CARDDAV_URL https://github.com/mstilkerich/rcmcarddav/releases/download/v5.1.0/carddav-v5.1.0.tar.gz
 
 RUN set -euxo pipefail \