You can now download Dotclear 2.6.4. This maintenance release includes fixes for two potential security defaults on XML-RPC system and on media manager.

Your dashboard should also offer you to upgrade your installation today or tomorrow (depending on your settings). There's also a patch for the developers who prefer this method.