Repository navigation
Request: off-schedule production rebuild for the 2026-10-21 PHP security release (8.3.36 / 8.4.27 / 8.5.12 / 8.2.35, CVE-2026-109618 / CVE-2026-109619) #723
Description
Summary
PHP released 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on 2026-10-21 fixing two critical (CVSS 4.0 9.2) unauthenticated RCEs, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp). The first advisory names FrankenPHP as likely susceptible, so the *-frankenphp variants are the most exposed. Upstream's guidance: "There are no complete mitigations, updating is the only safe choice."
The official php:8.3.36* images (including the -zts variants) are on Docker Hub as of ~16:00 UTC today, so a rebuild would pick the new versions up through scripts/get-php-versions.sh.
Request
Could a maintainer trigger Docker Publish (Production Images) (workflow_dispatch) ahead of the weekly Tuesday schedule? Left to the cron, the patched serversideup/php:8.3.36-* / 8.4.27-* / 8.5.12-* tags would not appear until 2026-10-27. If a v5.0.2 release carrying #718 is already planned, that release event would do the same.
Current state
- Newest published tags:
8.3.35-frankenphpetc. (weekly rebuild 2026-10-20 08:19 UTC) mainhas Upgrade FrankenPHP to v1.13.1 and skip compression for the Mercure hub #718 merged 2026-10-21 12:03 UTC, no publish run since
Thanks for maintaining these images; we build our production app on them.
Activity
TheDevilOnLine commentedon Oct 21, 2026
Please follow #721 and see #721 for the latest status
And the official images aren't published yet on docker hub, the tags have just been created and everyone's waiting for the builds to be pushed.
Oh look at that, while I was typing 8.3.36 was actually pushed to docker hub (2 minutes ago). Jay's build scripts should pick them up as soon as possible, keep your eye on that discussion thread.