diff --git a/ChangeLog b/ChangeLog
index 544d1f9038..17f3e6ad18 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
-4.5.4.0 (not yet released)
+4.5.4.1 (2016-01-29)
+- issue #11892 Error with PMA 4.4.15.3
+- issue #11896 Remove hard dependency on phpseclib
+
+4.5.4.0 (2016-01-28)
 - issue #11724 live data edit of big sets is not working
 - issue        Table list not saved in db QBE bookmarked search
 - issue #11777 While 'changing a column', query fails with a syntax error after the 'CHARSET=' keyword
@@ -29,6 +33,15 @@ phpMyAdmin - ChangeLog
 - issue #11854 Undefined property: stdClass::$releases at version check when disabled in config
 - issue #11814 SQL comment and variable stripped from bookmark on save
 - issue        Gracefully handle errors in regex based javascript search
+- issue        [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-1
+- issue        [Security] Unsafe generation of CSRF token, see PMASA-2016-2
+- issue        [Security] Multiple XSS vulnerabilities, see PMASA-2016-3
+- issue        [Security] Insecure password generation in JavaScript, see PMASA-2016-4
+- issue        [Security] Unsafe comparison of CSRF token, see PMASA-2016-5
+- issue        [Security] Multiple full path disclosure vulnerabilities, see PMASA-2016-6
+- issue        [Security] XSS vulnerability in normalization page, see PMASA-2016-7
+- issue        [Security] Full path disclosure vulnerability in SQL parser, see PMASA-2016-8
+- issue        [Security] XSS vulnerability in SQL editor, see PMASA-2016-9
 
 4.5.3.1 (2015-12-25)
 - issue #11774 Undefined offset 2
diff --git a/README b/README
index 02a210adcf..1c77549b88 100644
--- a/README
+++ b/README
@@ -1,7 +1,7 @@
 phpMyAdmin - Readme
 ===================
 
-Version 4.5.4
+Version 4.5.4.1
 
 A set of PHP-scripts to manage MySQL over the web.
 
diff --git a/doc/conf.py b/doc/conf.py
index 7a8ce0af02..6ba577ab12 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team'
 # built documents.
 #
 # The short X.Y version.
-version = '4.5.4'
+version = '4.5.4.1'
 # The full version, including alpha/beta/rc tags.
 release = version
 
diff --git a/libraries/Config.class.php b/libraries/Config.class.php
index 7065bc04b8..262791f117 100644
--- a/libraries/Config.class.php
+++ b/libraries/Config.class.php
@@ -114,7 +114,7 @@ class PMA_Config
      */
     public function checkSystem()
     {
-        $this->set('PMA_VERSION', '4.5.4');
+        $this->set('PMA_VERSION', '4.5.4.1');
         /**
          * @deprecated
          */
diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
index 4318502709..9033c6b557 100644
--- a/libraries/plugins/auth/AuthenticationCookie.class.php
+++ b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -41,7 +41,7 @@ if (! function_exists('openssl_encrypt')
     require PHPSECLIB_INC_DIR . '/Crypt/Base.php';
     require PHPSECLIB_INC_DIR . '/Crypt/Rijndael.php';
     require PHPSECLIB_INC_DIR . '/Crypt/AES.php';
-    require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
+    require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php';
 }
 
 /**
diff --git a/libraries/session.inc.php b/libraries/session.inc.php
index 4413c968f4..964a103578 100644
--- a/libraries/session.inc.php
+++ b/libraries/session.inc.php
@@ -13,7 +13,9 @@ if (! defined('PHPMYADMIN')) {
     exit;
 }
 
-require PHPSECLIB_INC_DIR . '/Crypt/Random.php';
+if (! function_exists('openssl_random_pseudo_bytes')) {
+    require_once PHPSECLIB_INC_DIR . '/Crypt/Random.php';
+}
 
 // verify if PHP supports session, die if it does not
 
@@ -113,7 +115,11 @@ if (! isset($_COOKIE[$session_name])) {
  * (we use "space PMA_token space" to prevent overwriting)
  */
 if (! isset($_SESSION[' PMA_token '])) {
-    $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
+    if (! function_exists('openssl_random_pseudo_bytes')) {
+        $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
+    } else {
+        $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
+    }
 }
 
 /**
@@ -132,5 +138,9 @@ function PMA_secureSession()
     ) {
         session_regenerate_id(true);
     }
-    $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
+    if (! function_exists('openssl_random_pseudo_bytes')) {
+        $_SESSION[' PMA_token '] = bin2hex(phpseclib\Crypt\Random::string(16));
+    } else {
+        $_SESSION[' PMA_token '] = bin2hex(openssl_random_pseudo_bytes(16));
+    }
 }