Skip to content

v5.0.2

Latest
Latest

Choose a tag to compare

View all tags
@jaydrogers jaydrogers released this 21 Oct 17:31
· 1 commit to main since this release
Immutable release. Only release title and notes can be modified.
v5.0.2
31651b0
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

馃毃 Critical PHP security update

Important

Update now. Patched images for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are live on Docker Hub and GitHub Packages. Every image was built and tested before anything was published. See #721 for how today's release unfolded.

Note

The CVEs below are in php/php-src upstream, not in this repo. This release rebuilds every image on the patched official Docker PHP images. We didn't need to change any code for it.

Upstream CVEs (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35)

CVE Severity Issue PHP advisory
CVE-2026-109618 Critical (9.2) Remote code execution through out-of-memory corruption GHSA-w8hw-w9fx-j79w
CVE-2026-109619 Critical (9.2) Remote code execution through stale global state GHSA-6wmf-4rv5-p3rp

Both can be exploited without logging in. See php.net's advisory for who is at risk.

PHP Version in this release
8.5 8.5.12
8.4 8.4.27
8.3 8.3.36
8.2 8.2.35
8.1 8.1.34 (not patched, end of life)

PHP 8.1 is end of life, so php.net didn't release a fix for it. If you're on 8.1, move to 8.2 or newer.

How to update

If you use Example Do this
A floating tag 8.4-fpm-nginx Pull and redeploy
A release tag 8.4-fpm-nginx-v5.0.1 Change it to 8.4-fpm-nginx-v5.0.2
A patch version tag 8.4.26-fpm-nginx Change it to 8.4.27-fpm-nginx

Then confirm you're on the patched version:

docker compose exec php php -v

馃悩 FrankenPHP v1.13.1

FrankenPHP 1.13.0, which shipped in v5.0.0 and v5.0.1, had several regressions. v1.13.1 fixes them, including:

  • Laravel and Symfony apps that use fastcgi_finish_request() over HTTP/2 could crash the process (php/frankenphp#2694)
  • Workers declared in the Caddyfile gave up after the first failed boot instead of retrying (php/frankenphp#2704)
  • php-cli passed the wrong $argv, which broke Symfony Console (php/frankenphp#2690)
  • Requests served during a graceful shutdown returned HTTP 500 (php/frankenphp#2644)
  • The process segfaulted when FrankenPHP restarted an unhealthy thread (php/frankenphp#2688)

We also made two fixes of our own in the FrankenPHP image:

  • The Mercure hub is no longer compressed. Each subscriber held its own compression encoder (a few MiB each with zstd). Compressing private updates also opens the door to BREACH-style attacks. Everything else is still compressed.
  • A failed extension install now fails the build. Before, if pecl.php.net timed out mid-build, the FrankenPHP image could publish without extensions like redis and zip. The other variations already worked this way.

Full Changelog: v5.0.1...v5.0.2

Assets 3
Loading