Skip to content

r9

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 18:37
· 15 commits to master since this release
r9
This tag was signed with the committer’s verified signature.
csandanov Chingis
SSH Key Fingerprint: K1PcEMY7yoA9YcynglpRo+5XMw0iLktneGM9hajINyg
Verified
Learn about vigilant mode.
580c163
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Update PHP to 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Update the MongoDB extension, PIE, and Walter in all images:

  • PHP 8.5.12 (from 8.5.11), 8.4.27 (from 8.4.26), 8.3.36 (from 8.3.35), and 8.2.35 (from 8.2.34) fix CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), both rated critical, and include other upstream bug fixes.
  • MongoDB extension 2.5.5 (from 2.5.3) fixes security issues when decoding BSON (CVE-2026-106436, CVE-2026-106432, CVE-2026-112368) and updates the bundled libmongoc to 2.5.6 and libmongocrypt to 1.20.5.
  • PIE 1.5.2 (from 1.5.1) includes bug fixes.
  • Walter 1.5.2 (from 1.5.1) is rebuilt with Go 1.27.3 to fix Go standard-library vulnerabilities. Its behavior is unchanged.

Known limitations:

  • The New Relic daemon from the latest New Relic PHP agent, 12.11.0.40, is built with Go 1.26.6 and golang.org/x/net 0.58.0, which have known vulnerabilities. New Relic has merged a fix but not yet released it. The daemon runs only when New Relic is enabled with PHP_NEWRELIC_ENABLED. See #255 for the affected advisories and remediation tracking.
  • Development images retain vulnerable dependencies bundled by npm pending a corrected upstream release. See #250 for the affected versions, advisories, and remediation tracking.
Assets 2
Loading