CVE-2026-109618 and CVE-2026-109619

PHP updates for the two critical CVEs will be released later today.

https://www.php.net/archive/2026.php#2026-10-20-1
https://cert.europa.eu/publications/security-advisories/2026-018/

Since RCE is likely possible (according to rumors circulating in certain circles), I wanted to ask how quickly you’ll rebuild the images.

Thanks in advance for your work.

Best regards,
Martin

Currently, Builds are Broken because PECL is down.
See the pipelines: https://github.com/webdevops/Dockerfile/actions/runs/39542385123

I'm currently investigating if we can switch to pie to get the build working again.

If the builds are working again I will also merge: #582 to disable session.upload_progress.enabled = Off.

If you want that partial fix right now you can use the env Variable: php.session.upload_progress.enabled = Off in your docker-compose.yaml

@Kanti

The partial fix is confirmed by PHP devs on Mastodon to not be sufficient.
We need a new build ready as soon as the official php fix is out.

@Kanti To add to the PIE switch - as far as I'm aware PIE requires PHP8.1+, so the images you manage should be an ideal match for this.

I'm not entirely sure if PIE has it's own package registry, but the reason PECL crashes is the fact it cannot connect to php.net which is more down than up today.
If PIE also connects to php.net then the issue with builds won't be resolved either way.

pie has packagist.org as registry.
Maybe pecl will be online by the time the patch rolls out.
I'm still on the migration.

pecl.php.net seams to work again. I'm currently building the #582.
I'm still on the migration, just in case.

The builds are fully operational again.

After the official Docker PHP images were released, we started the build, and ~45 minutes later, the production images will be uploaded to DockerHub.

@Kanti

@Kanti PHP has published the updates https://www.php.net/index.php#2026-10-20-1

We need to wait for the offical docker php images
https://hub.docker.com/_/php/tags?name=8.5.

PHP Dockers were just merged, therefore we're waiting for their image publish now.

We are still waiting for this PR:
docker-library/official-images#22541

lets' goooo, fix 8.4 & 8.3 too

we will fix 8.2 8.3 8.4 and 8.5

9. We are still waiting for this PR:
docker-library/official-images#22541

it's merged, goo

Still waiting on the availability of the images on docker hub: https://hub.docker.com/_/php/tags?name=8.5.

@Kanti

@Kanti, any chance you can also update version 7.4?

From another repo - https://doi-janky.infosiftr.net/job/put-shared/job/light/job/php/18635/console this seems to be the jenkins task that pushes those official images. Gives some idea of progress at least.

Aand yes.. it's one-by-one.

21. If anyone has a few bucks to spare, I could really use some coffee right now! ☕😅
I've been at my desk for 12 hours straight working on fixes for webdevops/Dockerfile. Send caffeine! 🚀
https://ko-fi.com/kanti_ or https://buymeacoffee.com/kanti

A fair request. Enjoy the coffee ☕️

I will start the first run of the pipeline. Hopefully, it will run through:
https://github.com/webdevops/Dockerfile/actions/runs/39637854386

@Kanti

Can confirm my rebuild of php-nginx-dev:8.4-alpine is now running on the patched php 8.4.27

See the link posted above & docker hub whether your desired image is ready.

Thank you, @Kanti

Some images still have wrong version on arm, still on it.

21. If anyone has a few bucks to spare, I could really use some coffee right now! ☕😅
I've been at my desk for 12 hours straight working on fixes for webdevops/Dockerfile. Send caffeine! 🚀
https://ko-fi.com/kanti_ or https://buymeacoffee.com/kanti

Fair request — and it’s been paid ☕ 😁

While I’m at it — and perhaps this is just me being impatient — the webdevops/php-nginx image hasn’t been updated yet, has it?

I restarted the run with the test from #590.
After that I'm curtain that all images got the new versions.
https://github.com/webdevops/Dockerfile/actions/runs/39648433196

For everyone still hanging on older PHP versions: #591
I hope you can Upgrade.

I'm happy to announce all webdevops/php* packages from 8.2 and up are now fixed. 🥳
Have a good time with your deployments 🚀
And see you all next time 🙃

New CVE dropped: CVE-2026-109619
New issue created: #592

Navigation Menu

Repository navigation

CVE-2026-109618 and CVE-2026-109619 #583

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

CVE-2026-109618 and CVE-2026-109619 #583

Description

Activity

Kanti commented on Oct 21, 2026

Jacobs63 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

ins0 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Jacobs63 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

muhmasum50 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

muhmasum50 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

syerad commented on Oct 21, 2026

8 remaining items

Jacobs63 commented on Oct 21, 2026

renzos42 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Jacobs63 commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

adhenrique commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Kanti commented on Oct 21, 2026

Kanti commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions