diff --git a/core/admin/start.py b/core/admin/start.py
index 1d30ca2c..ccc2e1ca 100755
--- a/core/admin/start.py
+++ b/core/admin/start.py
@@ -29,7 +29,7 @@ def test_unsupported():
     import codecs
     if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None) or os.environ.get(codecs.decode('ZNVYH_URYZ_PUNEG', 'rot13'), None):
         return
-    print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')
+    log.critical('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')
     while True:
         time.sleep(5)
 
diff --git a/towncrier/newsfragments/3024.misc b/towncrier/newsfragments/3024.misc
new file mode 100644
index 00000000..c5f34547
--- /dev/null
+++ b/towncrier/newsfragments/3024.misc
@@ -0,0 +1 @@
+Upgrade to roundcube 1.6.5 (fix XSS)
diff --git a/webmails/Dockerfile b/webmails/Dockerfile
index 51e0a98c..09fbd8ee 100644
--- a/webmails/Dockerfile
+++ b/webmails/Dockerfile
@@ -27,7 +27,7 @@ RUN set -euxo pipefail \
   ; mkdir -p /run/nginx /conf
 
 # roundcube
-ENV ROUNDCUBE_URL https://github.com/roundcube/roundcubemail/releases/download/1.6.4/roundcubemail-1.6.4-complete.tar.gz
+ENV ROUNDCUBE_URL https://github.com/roundcube/roundcubemail/releases/download/1.6.5/roundcubemail-1.6.5-complete.tar.gz
 ENV CARDDAV_URL https://github.com/mstilkerich/rcmcarddav/releases/download/v5.1.0/carddav-v5.1.0.tar.gz
 
 RUN set -euxo pipefail \