Updated Oct 22, 2026 at 5:30pm CDT

Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now.

Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages.

To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.

Updated Oct 21, 2026 at 4:40pm CDT

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21 at 14:00 UTC. Patched Chainguard packages and images are available now. We recommend you pull and redeploy any image that includes PHP 8.2 through 8.5. You're patched if your image has php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4 or php-8.5 8.5.11-r4 or later (frankenphp: 8.2.34-r3, 8.3.35-r2, 8.4.26-r2, 8.5.11-r2). The official 8.2.35, 8.3.36, 8.4.27 and 8.5.12 releases are also patched.

Images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, phpmyadmin, zabbix, renovate, privatebin and moodle, have been rebuilt with these versions. An earlier incident delayed image sync for some customer registries; as of 16:48 UTC every customer registry has the fixed standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips), and most images that bundle PHP have synced. A small number of custom images are still being updated. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds, so refresh your scanner to clear patched images.

For how to check your image's SBOM and update, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry doesn't have the fixed version, contact Support. Next update by October 22, 16:00 UTC.