diff --git a/CHANGELOG b/CHANGELOG
index 52c01e8b5..a596a4e28 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,8 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+RELEASE 1.2.8
+-------------
 - Fix check_request() bypass in places using get_uids() [CVE-2018-9846] (#6238)
 - Fix possible IMAP command injection vulnerability [CVE-2018-9846] (#6229)
 - Fix security issue in remote content blocking on HTML image and style tags (#6178)
diff --git a/index.php b/index.php
index 1d629dfbc..914373db9 100644
--- a/index.php
+++ b/index.php
@@ -2,7 +2,7 @@
 /**
  +-------------------------------------------------------------------------+
  | Roundcube Webmail IMAP Client                                           |
- | Version 1.2.7                                                           |
+ | Version 1.2.8                                                           |
  |                                                                         |
  | Copyright (C) 2005-2017, The Roundcube Dev Team                         |
  |                                                                         |
diff --git a/installer/index.php b/installer/index.php
index 085fd2dba..8e3f29559 100644
--- a/installer/index.php
+++ b/installer/index.php
@@ -3,7 +3,7 @@
 /**
  +-------------------------------------------------------------------------+
  | Roundcube Webmail setup tool                                            |
- | Version 1.2.7                                                           |
+ | Version 1.2.8                                                           |
  |                                                                         |
  | Copyright (C) 2009-2017, The Roundcube Dev Team                         |
  |                                                                         |
diff --git a/program/include/iniset.php b/program/include/iniset.php
index 59d612edd..139ca6365 100644
--- a/program/include/iniset.php
+++ b/program/include/iniset.php
@@ -21,7 +21,7 @@
 */
 
 // application constants
-define('RCMAIL_VERSION', '1.2.7');
+define('RCMAIL_VERSION', '1.2.8');
 define('RCMAIL_START', microtime(true));
 
 if (!defined('INSTALL_PATH')) {
diff --git a/program/lib/Roundcube/bootstrap.php b/program/lib/Roundcube/bootstrap.php
index aca8dbd63..930417ac9 100644
--- a/program/lib/Roundcube/bootstrap.php
+++ b/program/lib/Roundcube/bootstrap.php
@@ -55,7 +55,7 @@ foreach ($config as $optname => $optval) {
 }
 
 // framework constants
-define('RCUBE_VERSION', '1.2.7');
+define('RCUBE_VERSION', '1.2.8');
 define('RCUBE_CHARSET', 'UTF-8');
 
 if (!defined('RCUBE_LIB_DIR')) {