v5.1.2

🔐 Security update: Apache 2.4.71

Important

Pull and redeploy if you use fpm-apache. Apache 2.4.71 fixes a critical bug in mod_http2 that can lead to remote code execution (CVE-2026-119618). Our HTTPS virtual host turns on HTTP/2, so you're exposed if you run with SSL_MODE=mixed or full.

Note

This issue is in Apache httpd upstream, not in this repo. cli, fpm, fpm-nginx, and frankenphp are not affected.

---

🪶 Apache 2.4.71

CVE	Issue
CVE-2026-119618	Critical. A race in mod_http2 can corrupt the heap and lead to remote code execution. Affects 2.4.55 through 2.4.70.

2.4.71 also fixes bugs in mod_md and mod_vhost_alias. Our images don't load either module.

Debian doesn't have a fix yet. Bookworm was even further behind. It was still on 2.4.68 and missing the 2.4.69 fixes from October. The ones that apply to our default setup are a mod_http2 use-after-free (CVE-2026-57941) and two low-severity issues in mod_rewrite and mod_ssl.

Base OS	Before	Now
Debian Bookworm	2.4.68-1~deb12u1	2.4.71-1+0~deb.sury.org.1+debian12
Debian Trixie	2.4.69-1~deb13u1	2.4.71-1+0~deb.sury.org.1+debian13

Apache now comes from Sury

NGINX already installs from nginx.org. Apache doesn't publish its own packages. We now install it from Ondřej Surý's repository at packages.sury.org, which rebuilds Debian's own apache2 package on every upstream release.

It's the same Debian package. Nothing changes for you. a2enmod, envvars, /etc/apache2, and Debian modules like libapache2-mod-security2 all work like before.

• The build checks Sury's signing key fingerprint before it adds the repository
• Only apache2, libapr1, and libaprutil1 come from Sury. OpenSSL, curl, and everything else still come from Debian
• The Apache version is pinned per OS, and Renovate opens a PR when Sury ships a new build

How to update

If you use	Example	Do this
A floating tag	8.5-fpm-apache	Pull and redeploy
A release tag	8.5-fpm-apache-v5.1.1	Change it to 8.5-fpm-apache-v5.1.2
A patch version tag	8.5.12-fpm-apache	Pull and redeploy

If you build your own image FROM one of these, rebuild it too.

Then confirm the version:

docker compose exec php apache2 -v

🏗️ For contributors

• PHP base builds now read the release managers' GPG keys from php.net's keyring instead of keyserver.ubuntu.com, which kept timing out in CI. The build still only trusts the fingerprints docker-library lists. See How images are built

What's Changed

• Security: Install Apache 2.4.71 from Sury's repository, pinned per OS like NGINX by @jaydrogers in #747
• Read PHP's GPG keys from php.net's keyring instead of a public keyserver by @jaydrogers in #747

Full Changelog: v5.1.1...v5.1.2