Repository navigation
Critical PHP vulnerabilities #423
Description
PHP has announced two critical security issues being fixed today with a release (https://www.php.net/archive/2026.php#2026-10-20-1). Usually new versions of this image with new versions can take a few days or a week to release and I wanted to ask if there is a mechanism to maybe accelerate that for security releases, especially critical ones such as these.
Activity
iquito commentedon Oct 21, 2026
@mistraloz just wanted to ping you so this is not overlooked
moufmouf commentedon Oct 21, 2026
We are on it! Waiting for ondrej php to release patched release and we will rebuild the images.
iquito commentedon Oct 21, 2026
Thanks! I think the new releases by ondrej should be out, I already downloaded them for my systems where PHP is installed directly.
moufmouf commentedon Oct 21, 2026
The new versions are released! 🚀
regnerisch commentedon Oct 22, 2026
The current
thecodingmachine/php:8.5-v5-cli(alsothecodingmachine/php:8.5-v5-apache) image still appears to contain PHP 8.5.11, rather than 8.5.12.Image digest:
I pulled the image multiple times and als soon as I check the php version I get 8.5.11 as output.
mbrodala commentedon Oct 22, 2026
Generally I just noticed that there is no patch release after
8.5.0-v5-slim-apacheanymore. Is this intentional? If possible I'd like to keep explicit patch updates.moufmouf commentedon Oct 23, 2026
@regnerisch Are you sure? It's updated on my side:
@mbrodala Good question, we'll have to check this with @mistraloz . Given the fact that all patch releases before last Wednesday are compromised, are you sure tagging patch releases makes sense? (or maybe it's good to have immutable images 🤔 )
mbrodala commentedon Oct 23, 2026
I just generally wonder why there is no
8.5.1-v5-slim-apache,8.5.2-v5-slim-apache, etc. at all.mistraloz commentedon Oct 23, 2026
Sorry i just saw the issue (yes, last days was big days...). About the vulnerabilities, all is described here : https://github.com/thecodingmachine/docker-images-php/blob/v5/docs/security-php2shell.md (⚠️ for ARM version of the multiarch build, some php binnary - most of them - are not yet patched : i will try to relaunch the pipeline to fix that). In short : on ppa all arm binaries look like updated but on sury, they ware not yesterday (as i understand, that required long time to build all). BTW : i will look for that and close again the issue when all will be fixed (including arm one).
About the avaibility of minor immutable tag, that is a bug from end of 2025 (in my release to update the CI process, i forgot a parameter). I will fix it with #425 when sury finishing to publish all new php packages for arm (i asked claude to check that for me).
mistraloz commentedon Oct 23, 2026
And, about patching the images of the older PHP patch versions (or deleting the vulnerable tags): I will not do it. These tags are immutable, and PHP itself does not provide the fix for previous versions. The only exception is PHP 7.4 to 8.1, and honestly, it is the best of the bad options: relying on PHP 7.4 to keep an old Drupal/WordPress/Symfony/Laravel application secure is just a joke.
PS: For the same reasons, i will deploy 7.4.33-php2shell-v5- (and not errasing 7.4.33-v5- ) but i am not sure of this choice.