ownCloud Docker images updated for PHP CVE-2026-109618 and CVE-2026-109619

[kw-tmueller]

ownCloud Docker images updated for PHP CVE-2026-109618 and CVE-2026-109619

The owncloud/server images for ownCloud 10 and ownCloud 11 now ship PHP packages with the fix for both CVEs. Please pull and redeploy.

Get it

# ownCloud 11
docker pull owncloud/server:11.0.1
# ownCloud 10
docker pull owncloud/server:10.16.6

All tags of each line point to the same image, built 2026-10-22 for amd64 and arm64:

Line	Tags	Digest	PHP package
ownCloud 11	11.0.1-20261022, 11.0.1, 11.0, 11	sha256:bacdc811…	8.3.6-0ubuntu0.24.04.13 (Ubuntu 24.04, USN-8948-1)
ownCloud 10	10.16.6-20261022, 10.16.6, 10.16, 10, latest	sha256:879638cd…	1:7.4.33-31 (Ubuntu 22.04, Freexian PHP LTS)

If you already pulled the earlier ownCloud 11 build sha256:31cf2a61… (2026-10-22, 00:03 UTC), you were already covered. It ships the same fixed PHP packages.

Docker Hub: https://hub.docker.com/r/owncloud/server

Why php -v still shows the old version

The images use distribution packages, and those backport security fixes instead of moving to new upstream releases. php -v reports 8.3.6 or 7.4.33 before and after the fix. Only the package version tells you whether you have the fix.

Check your container

libapache2-mod-php is the package that handles web requests, so it's the one to check.

ownCloud 11:

dpkg -s libapache2-mod-php8.3 | grep Version
# Version: 8.3.6-0ubuntu0.24.04.13

ownCloud 10:

dpkg -s libapache2-mod-php7.4 | grep Version
# Version: 1:7.4.33-31+freexian22.04.1+php+1

If you see .13 (ownCloud 11) or -31 (ownCloud 10), you're covered. All packages built from the PHP source in each image are at that version. The two CVEs are also listed in the package changelog under /usr/share/doc/php8.3-cli/ or /usr/share/doc/php7.4-cli/.

Some php*- packages show other version numbers, for example apcu, redis and imagick. They're separate PECL extensions with their own sources, and this fix doesn't touch them.

Details and discussion: owncloud-docker/php#324

Questions or problems? Reply here.

[jordanafung]

Just adding to what Thomas stated above:
Please update your ownCloud Classic installations immediately to the latest versions.
ownCloud Classic versions 11.0.1 and 10.16.6 have been updated and hold the patched php runtime

Docker image page - https://hub.docker.com/r/owncloud/server

Note: Customers not running docker version of OwnCloud Classic should update the PHP themselves

Upgrade instructions:
How to Upgrade Your ownCloud Classic

There are also security updates for users on ownCloud Classic that are using the Calendar app Calendar: ownCloud Marketplace - v2.1.1 and v2.0.1
These are Security updates - Please update immediately

[heinihuber]

owncloud/server:10.16.6 still ships unpatched PHP 7.4 (CVE-2026-109618 / CVE-2026-109619)

The announcement on ownCloud Central (2026-10-22) states that owncloud/server:10.16.6 has been updated and holds the patched PHP runtime. On our side, the freshly pulled 10.16.6 image still contains a PHP 7.4 build without the PHP2Shell fix.

Image

• Tag: owncloud/server:10.16.6
• Image ID: sha256:9c306315e910c32c428643ee5911d6c4acfa2ceca4b60a7e0a4816519be5af32
• Created: 2026-10-22T00:02:58Z
• Container recreated from this image after pulling

Installed PHP packages (dpkg -l inside the container)

ii  libapache2-mod-php7.4  1:7.4.33-30+freexian22.04.1+php+1  amd64
ii  php7.4-cli             1:7.4.33-30+freexian22.04.1+php+1  amd64
ii  php7.4-common          1:7.4.33-30+freexian22.04.1+php+1  amd64

Latest changelog entry (/usr/share/doc/php7.4-common/changelog.Debian.gz)

php7.4 (1:7.4.33-30+freexian22.04.1+php+1) php-jammy; urgency=medium

  * No-change backport to jammy.

 -- Ondřej Surý <ondrej@debian.org>  Fri, 03 Jul 2026 08:06:05 +0200

php7.4 (1:7.4.33-30) unstable; urgency=medium

  * Backported from 8.2.32
   + Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with
     AES-WRAP-PAD.

The newest entry dates from July 2026. There is no entry for CVE-2026-109618 / CVE-2026-109619 or the upstream backport ("Avoid state corruption via bailout"). As far as we can tell, the fix for PHP 7.4 in the Sury repository is in revision -31. It looks like the image was rebuilt before that revision was available.

Since the image runs PHP as an Apache module (mod_php), this is the configuration with the highest risk for these vulnerabilities.

Questions

1. Can you confirm which PHP package revision the patched 10.16.6 image is supposed to contain?
2. Is a rebuild of 10.16.6 / 10 / latest planned with the fixed PHP 7.4 packages? If so, could you post the new image digest here so admins can verify?

[Jonas096]

Yes! We face the same issue. Its still an old php version on owncloud/server:10

[heinihuber]

Thank you for your confirmation @Jonas096!

[kw-tmueller]

Thanks for the detailed report. The image you have (9c306315…, created 2026-10-22T00:02:58Z) is an earlier build from the same day, made before the fixed PHP packages were available. The tags 10.16.6, 10.16, 10 and latest were moved to the fixed build at 09:18 UTC.

1. The fixed revision is 1:7.4.33-31+freexian22.04.1+php+1. Its changelog entry lists CVE-2026-109618, CVE-2026-109619: Avoid state corruption via bailout.
2. No new rebuild is needed. The fixed image is already published:
   • index digest sha256:879638cd818b4c60c79f0dbf351fe1814e899c74782b0c20ecb055e542c260b6
   • Image ID (what docker image inspect shows) on amd64: sha256:22b4929e21281281f58a3ad845e39db7baef6a2dd38f4162e86d23a93e1682ae, created 2026-10-22T09:17:06Z
   • Image ID on arm64: sha256:bf61d46f0941218ff1e91093a5930f2630e0bd538884b3c0222ef8390e22b7d9

If you still get the old image, run docker pull owncloud/server:10.16.6 again and recreate the container (docker compose pull && docker compose up -d). If you pull through a registry mirror or cache, refresh it or pull by digest: owncloud/server@sha256:879638cd818b4c60c79f0dbf351fe1814e899c74782b0c20ecb055e542c260b6.

@Jonas096 the same applies to owncloud/server:10.

[heinihuber]

Confirmed fixed: the updated image ships 1:7.4.33-31+freexian22.04.1+php+1, changelog includes the backport for CVE-2026-109618/109619. Thanks for the quick rebuild