diff --git a/src/variations/cli/Dockerfile b/src/variations/cli/Dockerfile
index afbed7ec..9bc60bfc 100644
--- a/src/variations/cli/Dockerfile
+++ b/src/variations/cli/Dockerfile
@@ -8,8 +8,11 @@ ARG PHP_VARIATION='cli'
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     libbrotli1 \
diff --git a/src/variations/fpm-apache/Dockerfile b/src/variations/fpm-apache/Dockerfile
index d6783957..96a02e9e 100644
--- a/src/variations/fpm-apache/Dockerfile
+++ b/src/variations/fpm-apache/Dockerfile
@@ -23,8 +23,11 @@ RUN docker-php-serversideup-s6-install
 ##########
 FROM ${BASE_IMAGE}
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     apache2 \
     fcgi \
     shadow"
diff --git a/src/variations/fpm-nginx/Dockerfile b/src/variations/fpm-nginx/Dockerfile
index 70021770..99a7f322 100644
--- a/src/variations/fpm-nginx/Dockerfile
+++ b/src/variations/fpm-nginx/Dockerfile
@@ -98,10 +98,13 @@ RUN \
 ##########
 FROM ${BASE_IMAGE}
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
     fcgi \
     gettext \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     gettext-base \
diff --git a/src/variations/fpm/Dockerfile b/src/variations/fpm/Dockerfile
index 6976a67d..f98a35ee 100644
--- a/src/variations/fpm/Dockerfile
+++ b/src/variations/fpm/Dockerfile
@@ -8,9 +8,12 @@ ARG PHP_VARIATION='fpm'
 FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION}
 
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
     fcgi \
+    libcurl \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\
     libbrotli1 \
diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile
index a9ca1079..d06e6284 100644
--- a/src/variations/frankenphp/Dockerfile
+++ b/src/variations/frankenphp/Dockerfile
@@ -163,8 +163,11 @@ RUN if cat /etc/os-release | grep -q 'debian'; then \
 ####################
 FROM common AS final
 # brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix.
+# curl and libcurl upgrade Alpine past curl 8.22.0 (CVE-2026-86409 and others). Remove them once the official PHP images ship 8.23.0.
 ARG DEPENDENCY_PACKAGES_ALPINE="\
     brotli-libs \
+    curl \
+    libcurl \
     libstdc++ \
     shadow"
 ARG DEPENDENCY_PACKAGES_DEBIAN="\