Faved v2.10.1: critical PHP security patch, please update your Docker image

[denho]

v2.10.1 – Security patch: PHP 8.5.12 (PHP2Shell)

This is a security-only release. It updates the PHP runtime in the Docker image to PHP 8.5.12, which fixes two critical remote code execution vulnerabilities in PHP core disclosed on October 21, 2026 and nicknamed "PHP2Shell". There are no application changes. All Docker-based installations should update immediately.

Security

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) – Updated the Docker base image from PHP 8.5 to PHP 8.5.12-apache. Both vulnerabilities are rated Critical (CVSS v4.0 9.2) by the PHP security team and can allow unauthenticated remote code execution on any PHP installation serving web requests, including Apache with mod_php as used by Faved. See the PHP security advisory for details.

Under the hood

• Pinned the base image in Dockerfile.build and Dockerfile.dev to php:8.5.12-apache so the patched runtime is used explicitly rather than relying on the floating 8.5-apache tag.

How to update

Follow instructions on this page: https://faved.to/docs/getting-started/updating.

To confirm the container is on the patched runtime:

docker exec faved-web-app php -v

It should report PHP 8.5.12 or later.

If you run Faved outside Docker, update your system PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later).

Full Changelog: v2.10.0...v2.10.1

---

This discussion was created from the release v2.10.1.

[elasticizer]

@denho Hello! Thanks for the recent security updates.

While checking the latest release, I noticed a couple of version inconsistencies:

1. The "About" modal still displays 2.10.0.
2. The version field inside app-info.json was not updated to reflect the new release version.
   

   faved/app-info.json

   Line 2 in 51dbfa8

   "version": "2.10.0"

Both are expected to be updated to version 2.10.1. Could you please look into updating these to ensure proper version tracking, accurate downstream packaging, and clear status reporting for users?

Thanks again for your continuous maintenance and quick response to security issues!

[denho]

Hi @elasticizer
Thank you for noticing and reporting this.

v2.10.1 was published quickly to ship the PHP security fix, and the app version in the manifest wasn’t bumped, that's why it was still showing the previous 2.10.0 in the About page. This has been fixed now.