Security update: please update your self-hosted Hi.Events (PHP CVE-2026-109618, CVE-2026-109619)

[daveearley]

PHP released security fixes on 21 October for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 and can lead to remote code execution on any PHP install that serves web requests, including the PHP-FPM setup in our Docker images.

Hi.Events Cloud is already patched. If you self-host, please update.

Every Hi.Events image published before 21 October runs an affected PHP version. These releases are patched:

Release	PHP
v2.0.0-rc.3 (also latest)	8.5.12
v1.11.2-beta	8.4.27 (backend), 8.3.36 (all-in-one)

v1.11.2-beta is the same code as v1.11.1-beta, rebuilt on patched PHP. If you're on v1 and not ready to move to v2, use that.

How to update

Using our images from Docker Hub

Set the image tag in your docker-compose.yml to v1.11.2-beta or v2.0.0-rc.3, then run:

docker compose pull
docker compose up -d

Warning

latest now points to v2. If you're on v1 and your compose file uses latest, pulling will upgrade you to v2. Pin v1.11.2-beta instead, or follow the upgrade steps in the v2.0.0-rc.3 release notes and back up your database first.

Building from the repo (the git clone setup from the README)

The docker-compose.yml in this repo builds the image locally, so you need to check out a patched release and rebuild. Use v1.11.2-beta to stay on v1, or v2.0.0-rc.3 to move to v2 (back up first, see the warning above):

cd hi.events
git fetch --tags
git checkout v1.11.2-beta
cd docker/all-in-one
docker compose build --pull
docker compose up -d

If you run the separate backend and frontend services instead, run the same build --pull and up -d in docker/backend. The frontend doesn't use PHP.

--pull matters here. Without it Docker reuses the old PHP base image you already have.

Your own Dockerfile or a non-Docker install

Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. If you build on serversideup/php, rebuild with --pull. Then restart PHP-FPM so no old workers stay running.

Check it worked

docker compose exec all-in-one php -v

If you run separate services, use your backend service's name instead of all-in-one (hi-events-backend in our compose file). It should show one of the patched versions above.

If you can't update right away

php.net lists temporary mitigations that reduce exposure, but they don't fix the problem. Updating is the only real fix.

If you run into problems, reply here.