A webmail client is a browser front end to a mailbox that lives somewhere else. It speaks IMAP to read mail and SMTP to send it, and it stores almost none of the mail itself: what it keeps is your address book, your preferences and your signatures. That distinction matters more than it sounds, because it means installing one does not move your email, and it does not back your email up.
Roundcube is the one that is alive. Version 1.7.0 arrived in May 2026 after nearly four years of development, and 1.7.3 followed on 9 August 2026 with a batch of security fixes. It needs PHP 8.1 or newer, and since November 2023 the project has been under Nextcloud's stewardship after its founder stepped back. Almost every host that ships a webmail client ships this one. SquirrelMail is the one that is not. Its last numbered release, 1.4.22, came out on 12 July 2011. Everything since has been unreleased development snapshots, and cPanel dropped it from its webmail options in version 78 rather than carry on patching it.
Before you install either, read this bit. Every 365i hosting plan already includes webmail on every mailbox, so running your own is a niche choice. It is a reasonable one for two situations: you want webmail on your own domain carrying your own branding, or you need a browser client for an IMAP account that is not hosted here at all. Outside those two, you are mostly adding something else to patch.