Critical PHP security release 2026-10-21 (CVE-2026-109618, CVE-2026-109619)

[jaydrogers]

Tip

Patched images are live for v5 and v4. Update now.

Release	Patched PHP versions	Release notes
v5.0.2	8.5.12, 8.4.27, 8.3.36, 8.2.35	v5.0.2
v4.5.3 (for people who can't move to v5 yet)	8.5.12, 8.4.27, 8.3.36, 8.2.35	v4.5.3

Last updated: (see upper right of this post)

On October 21, the PHP security team released the fix for two critical vulnerabilities in PHP (CVSS v4.0 score of 9.2 out of 10):

• CVE-2026-109618: remote code execution through out-of-memory corruption
• CVE-2026-109619: remote code execution through stale global state

Both can be exploited without logging in. php.net says every PHP install that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

You don't need the temporary mitigations anymore. Update your images and you're covered.

How to update

Find the tag you use below:

Tag	Example	Do this
Floating	8.4-fpm-nginx	Pull and redeploy. It's already patched on v5.0.2.
v5 release	8.4-fpm-nginx-v5.0.1	Change it to 8.4-fpm-nginx-v5.0.2
v4 release	8.4-fpm-nginx-v4.5.1	Change it to 8.4-fpm-nginx-v4.5.3
Patch version	8.4.26-fpm-nginx	Change it to 8.4.27-fpm-nginx

Release tags never change. If you pin one, change the pin to get the fix.

Then pull and redeploy:

docker compose pull
docker compose up -d

If you build your own image FROM serversideup/php, add --pull so Docker grabs the new base image instead of reusing the old one from its cache:

docker compose build --pull
docker compose up -d

Then confirm you're on the patched version (swap php for your service name):

docker compose exec php php -v

Our upgrade guide explains how each tag type works.

A note for v4 users

v4.5.3 is published to release tags only, like 8.4-fpm-nginx-alpine-v4.5.3. Floating tags like 8.4-fpm-nginx stay on v5. That way nobody on a floating tag gets moved between v4 and v5 by accident. Thanks to @peaklabs-dev for the idea.

It also updates NGINX to 1.30.6, which brings over the NGINX fixes from v5.0.1. v4.5.2 was tagged but never published. Go straight from v4.5.1 to v4.5.3.

This was a one-off because of how severe these CVEs are. Plan your move to v5 when you can.

Which images got the fix

Images	Patched?	Why
PHP 8.2, 8.3, 8.4, and 8.5	✅ Yes	php.net released a fix for each of these
PHP 8.1	❌ No	php.net only published a source patch, so the official Docker image didn't get it
PHP 7.4 and 8.0	❌ No	We stopped building these on September 3, 2026
Anything on Debian Bullseye or Alpine 3.16	❌ No	We stopped building these on September 3, 2026

If you're on one of the ❌ rows, this is your push to upgrade to PHP 8.2 or newer. Our security policy explains why those images stopped getting updates.

Thank you

Thanks to everyone who kept this thread helpful today. A lot of you tracked the upstream builds and answered each other's questions, which made this a lot easier.

Also, thank the people who keep PHP secure. Most of them are volunteers. They put in a lot of extra hours this week to keep your servers safe.

✌️ Jay

[magweter]

Great work @jaydrogers, and thanks for the clear timeline! Most major businesses and government organisations here in the Netherlands have taken their sites offline as a precaution. You can imagine the number of worried customers calling in 😅 what a day it has been already..

[jaydrogers]

It's days like today where I am REALLY grateful we decided to use containers and ensure our images run as www-data and NOT root 😅

[lotfiouss]

Thanks for the update
Just to confirm, will the v5.0.2 release also include patched PHP 8.2 images?

[jaydrogers]

Just added this as you posted 😄

[mohin-simform]

Great work, @jaydrogers 👏

Just wanted to confirm, will Version 4.5 continue to receive security updates and fixes?

Since we have some custom changes in place, upgrading to Version 5 is not feasible for us at the moment. Would it be possible to backport the security fixes to Version 4.5 as well? We would really appreciate it if this could be considered.

Thanks for your great work and support!

[jaydrogers]

Oof, not sure if I can get 4.x to update or not. I will see if I can re-run a job from the latest 4.x release and see if it will pick up the new patches.

[peaklabs-dev]

@jaydrogers If you can not we will release a v4.5 image also built form PHP directly so we can patch Coolify faster coollabsio/coolify#12256 at least for PHP 8.4

[jaydrogers]

I think I should be able to go back in time, and run a hot fix off the latest 4.x branch. I will prioritize our 5.x builds first.

I am just worried once this patch is available everything will be down because everyone is trying to build at once.

Good news is 5.x came with "breaking changes" but I don't think they were too bad?

[peaklabs-dev]

Yes that is true but for backporting to other minior versions we can not upgrade to v5

[kenarsuleyman]

Do we know lsphp binaries from openlitespeed team also effected of this?

[jaydrogers]

If they compile anything from PHP's source code, I would assume yes?

Still no official information from php.net. It's scheduled to be available within the next 20 minutes or so.

[TheDevilOnLine]

Yes, lsphp is affected as well, some of the published exploits target lsphp specifically, since they are more easy vulnerable to the exploit that plain PHP (this has to do with the predictability of certain memory addresses)

[veryard]

https://www.php.net/archive/2026.php#2026-10-21-5

[glalo]

can we update right now?

The official PHP container images with the update have not yet been published. This process may take some time.

[jaydrogers]

Just updated the post with the mitigation steps provided by PHP. Not the easiest right now, but wanted to get information out there as soon as I had it.

Still waiting on the official PHP images to be built 😅

[sawirricardo]

i really wish we have insider to speed up things

[jessedobbelaere]

@sawirricardo The official docker php images are still running CI, it would need to be merged and an upstream merge onto docker-library/official-images needs to happen with subsequent image builds. And only then, serversideup/php can build...

[matteo0402]

Merged now!

[CloudPassenger]

Thanks for keeping all of this in one place, Jay.

I know 7.4 and 8.0 stopped building on September 3, and that 8.1 won't get the fix because the official Docker image won't. Still, I'd like to ask whether you would consider a one-off build of the 7.4, 8.0, and 8.1 images from the source backports the PHP security team published with the advisory:

• PHP 7.4: https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
• PHP 8.0: https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
• PHP 8.1: https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

The advisory says the security team provided these "given the severity of these vulnerabilities" and "to help people building from source or without access to an LTS vendor". That describes a lot of people running these images.

We still have a legacy app on 7.4.33. Upgrading to 8.2 is the plan, but it won't happen this week. In the meantime we've applied session.upload_progress.enabled=0, and php.net is clear that the mitigations only reduce exposure. A patched image, even outside the normal release tags, would cover us until the migration is done. I doubt we're the only ones in that position.

If this is out of scope, I understand.

[jaydrogers]

They would have to build a Docker image that includes 7.4. Unfortunately it looks like they're only doing 8.2 and higher: docker-library/php#1694

[elcapo]

PR merged and closed! 🥳 docker-library/php#1694

[elcapo]

The process is waiting because a CI job can't write in a GitHub issue because it's locked. 😅

Source: https://github.com/docker-library/official-images/actions/runs/39617274432/job/119281598810?pr=22541

[elcapo]

I think that the issue is that the CI job is trying to add a comment to the PR but it can't because comments were closed because it was too heated. 😅

[ron-florax]

They unlocked it finally, filling up with pointless comments...

[elcapo]

PR approved! docker-library/official-images#22541 (review)

[ron-florax]

How do they not notice the pipeline has stalled? I figured that out half and hour ago

[pestaa]

Awesome communication, Jay! Very happy with serversideup images, been using it in all my work.

[webnoob]

Excellent work sorting it all, we appreciate it.

Can we please get an "@here" on the Discord channel when this goes live please?

[jturazzi]

Done ! https://github.com/docker-library/php

[iksaku]

This is still needing to land: docker-library/official-images#22541

[jturazzi]

[sertxudev]

Here we go!

[elcapo]

No Netflix series has ever captured my attention the way GitHub did today.

[ps-20x]

If you click on them they look done already

[jaydrogers]

Bigger issues 😅

https://www.githubstatus.com/

[nicola-net7]

One left!

[jturazzi]

[jturazzi]

@elcapo

[nicola-net7]

Done!!!

[tim-hanssen]

Crazy how long this takes

[LaurinStapf]

docker-library/official-images#22541 is merged...

[nicola-net7]

Merged!

[jaydrogers]

Now we have to wait for a build.

If anyone remembers how to read Jenkins, let me know 😅

https://doi-janky.infosiftr.net/

[tim-hanssen]

Any idea on how long this will take?

[Andrewpk]

I always find crying first and then looking at jenkins prepares me for the worst...definitely makes it easier to read when the bad news hits 😭

[tschoffelen]

The first ones are dropping into Docker Hub, should be all there in the next 5 mins I expect

[jaydrogers]

It's going to be much longer than 5 minutes unfortunately. Tags are created before images are actually built.

You can monitor the progress here https://doi-janky.infosiftr.net/job/meta/view/All/builds

[peaklabs-dev]

If anyone needs a temporary v4.5 image, we have had a full build for over an hour (build from source) https://github.com/coollabsio/coolify/pkgs/container/serversideup-php

[sertxudev]

The Laravel Twitter account posted that they are applying PHP security patches to their last two regions; I thought they used ServerSideUp images, but I might be wrong 🤔

[harrisonratcliffe]

They've probably moved away after the delay.

[martijnvanonz]

Let's gooooooo!

[osolarik]

I hope that one day Netflix will make documentary about this day.

[graphicmist]

I dont think they use php

[laoneo]

It was just a joke

[dsgepers]

We will never hear the end of it from those node devs...

[Andrewpk]

you sure they're not busy with a supply chain attack or something like they usually are? 😄

[bradley-varol]

I saw a tweet saying the exploit is still possible with 8.5.12 - anyone know anything?

[jaydrogers]

Update: I'm building v5.0.2

Everything came back green. Now PECL needs to stay up

https://github.com/serversideup/docker-php/actions/runs/39644565049

[yhjohn]

Greens!!

[hubertkoy]

Green light / Red Light - squid game :D

[phoenixvv]

testing .....

[Mahoke]

Tysm jay

[typoniels]

publishing ... Wooop Wooop 💪

[martijnvanonz]

@jaydrogers Thank you so much!

[soeren-helbig]

@jaydrogers really appreciate your work mate!!!!

[marns93]

@jaydrogers Thank you so much!

Woop woop, finally I can bump.

[tschni]

There it is! 🚀

[LaurinStapf]

@jaydrogers thank you!

[twiesing]

Thanks for the fast, transparent handling 🙏 @jaydrogers

I opened an Ideas request to auto-rebuild when the upstream base digest changes, so future security releases propagate automatically: #724

[elcapo]

Yeah!

[jaydrogers]

Update: All images are live 🥳

I will update the top comment with more detail, but if you use v5.0.2 you'll get the latest release with the security fixes.

How to update

If you use	Example	Do this
A floating tag	8.4-fpm-nginx	Pull and redeploy
A release tag	8.4-fpm-nginx-v5.0.1	Change it to 8.4-fpm-nginx-v5.0.2
A patch version tag	8.4.26-fpm-nginx	Change it to 8.4.27-fpm-nginx

THE BEST WAY TO CONFIRM YOU HAVE THE RIGHT IMAGE

👉 Run php -v inside your container and confirm you have the latest PHP version.

[pr0pz]

Nice, finally! Thank you very much, we really appreciate it :)

[AurelienLab]

Thank you @jaydrogers for the reactivity and everything !

[DouglasAR01]

Thanks, @jaydrogers 🚀

[christiancable]

Thank you!

[tim-hanssen]

Thank you for all the work @jaydrogers !!

[jaydrogers]

Update: I am trying to work on a v4 fix too

For the people who cannot go to v5, I am trying to get a v4 fix out the door -- but if I run it, it will overwrite the fpm-nginx tags as "latest". That would not be good 😊

👇 If you have thoughts, please chime in below

cc: @peaklabs-dev

[peaklabs-dev]

We solved it by just releasing named versions, so v4.4.7 is latest, and v4.3.24 was a backport (separate CI workflow) with just that tag and no latest. I think that since everyone that is still on v4 needs to pin the serversideup version explicitly anyway, like 8.4-fpm-nginx-alpine-v4.5.1. Just releasing a patch version is fine, so 8.4-fpm-nginx-alpine-v4.5.2 and for other variants the same just a v4.5.2 patch version.

[jaydrogers]

Just released serversideup/php v4.5.3. This includes the backport fix https://github.com/serversideup/docker-php/releases/tag/v4.5.3

[toxsick]

Thanks @jaydrogers for coordinating this! We use serversideup/php:8.5-frankenphp. Could you confirm whether this tag will include PHP 8.5.12 with v5.0.2, or whether the FrankenPHP variant has a separate upstream dependency/timeline?

[jaydrogers]

You can confirm it with this command:

docker run --rm serversideup/php:8.5-frankenphp php -v

Which gives you the PHP version of PHP 8.5.12:

8.5-frankenphp: Pulling from serversideup/php
Digest: sha256:71a83d3f19db797f54378e45b578ea36dfdb5dda4dc054f66cdba8bb3026093e
Status: Image is up to date for serversideup/php:8.5-frankenphp

--------------------------------------------------------------------
 ____                             ____  _     _        _   _
/ ___|  ___ _ ____   _____ _ __  / ___|(_) __| | ___  | | | |_ __
\___ \ / _ \  __\ \ / / _ \  __| \___ \| |/ _` |/ _ \ | | | |  _ \
 ___) |  __/ |   \ V /  __/ |     ___) | | (_| |  __/ | |_| | |_) |
|____/ \___|_|    \_/ \___|_|    |____/|_|\__,_|\___|  \___/| .__/
                                                            |_|

Brought to you by serversideup.net
--------------------------------------------------------------------

📚 Documentation: https://serversideup.net/php/docs
💬 Get Help: https://serversideup.net/php/community
🙌 Sponsor: https://serversideup.net/sponsor

-------------------------------------
ℹ️ Container Information
-------------------------------------
📦 Versions
• Image:         v5.0.2-39644565049
• PHP:           8.5.12
• OS:            Debian GNU/Linux 13 (trixie)

👤 Container User
• User:          www-data
• UID:           33
• GID:           33

⚡ Performance
• OPcache:       ❌ Disabled
• Memory Limit:  256M
• Upload Limit:  100M

🔄 Runtime
• Automations:
• Docker CMD:    php -v

👉 [NOTICE]: Improve PHP performance by setting PHP_OPCACHE_ENABLE=1 (recommended for production).
PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:19) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.12, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

[jaydrogers]

Update: For those who can't go to v5 yet

We have v4.5.3 available https://github.com/serversideup/docker-php/releases/tag/v4.5.3

How to update

Find the tag you use below:

Tag	Example	Do this
Floating	8.4-fpm-nginx	Pull and redeploy. It's already patched on v5.0.2.
v5 release	8.4-fpm-nginx-v5.0.1	Change it to 8.4-fpm-nginx-v5.0.2
v4 release	8.4-fpm-nginx-v4.5.1	Change it to 8.4-fpm-nginx-v4.5.3
Patch version	8.4.26-fpm-nginx	Change it to 8.4.27-fpm-nginx

Release tags never change. If you pin one, change the pin to get the fix.

Then pull and redeploy:

docker compose pull
docker compose up -d

If you build your own image FROM serversideup/php, add --pull so Docker grabs the new base image instead of reusing the old one from its cache:

docker compose build --pull
docker compose up -d

Then confirm you're on the patched version (swap php for your service name):

docker compose exec php php -v

Our upgrade guide explains how each tag type works.

A note for v4 users

v4.5.3 is published to release tags only, like 8.4-fpm-nginx-alpine-v4.5.3. Floating tags like 8.4-fpm-nginx stay on v5. That way nobody on a floating tag gets moved between v4 and v5 by accident. Thanks to @peaklabs-dev for the idea.

It also updates NGINX to 1.30.6, which brings over the NGINX fixes from v5.0.1. v4.5.2 was tagged but never published. Go straight from v4.5.1 to v4.5.3.

This was a one-off because of how severe these CVEs are. Plan your move to v5 when you can.

[hktang]

YOU ARE A STAR! Thank you for your hard work. Best regards from GMT+9.

[jaydrogers]

Update: Post Mortem and reflection now available

Thanks to everyone for your patience today! Wow, did I learn a lot 😅

I wanted to take some time to reflect on where we can improve, so I opened this discussion here:

• Improving future security releases and reducing dependencies on upstream builds (Post-mortem: PHP2Shell security release) #727

I'd love to hear your thoughts! I am hoping when the next one drops, we just build from GitHub Source and go from there.

Hope you're all patched and resting!

✌️ Jay

[soeren-helbig]

legend! @jaydrogers