Repository navigation
Upcoming Critical PHP Security Release (2x CVSS v4.0 9.2) #253
Description
The PHP security team has announced that they will be releasing critical security fixes for all supported PHP versions on Wednesday, 21 October 2026 at 14:00 UTC (see https://www.php.net/archive/2026.php#2026-10-20-1).
Details about the specific security issues have not been made public yet, but the CVSS v4.0 9.2 rating implies a ciritcal issue that will likely allow remote code execution on vulnerable servers.
I strongly urge the team to release updated versions of the wodby/php images that include the aforementioned upstream PHP updates as soon as possible, ideally directly after they are released by PHP.
Reacted by Josef Brennecke, Onni Aaltonen, Matti Vakkilainen, Peter Sjöholm, Christian Foidl, Florian Wust, Tomas Fülöpp, Lionel Enkaoua, Koen van Meijeren, mmv93 and 2 more
Activity
SanderWind commentedon Oct 21, 2026
It has landed: https://www.php.net/archive/2026.php#2026-10-21-5
LvckyAPI commentedon Oct 21, 2026
but not as wodby image?
csandanov commentedon Oct 21, 2026
we're waiting for official images release that our images based on docker-library/php#1694
mmv93 commentedon Oct 21, 2026
docker-library/php#1694 merged
csandanov commentedon Oct 21, 2026
we're now waiting once all images are built for arm/amd
LvckyAPI commentedon Oct 21, 2026
thank you @csandanov
mmv93 commentedon Oct 21, 2026
Does anyone know if fix for https://github.com/wodby/drupal-php will be ready today?
csandanov commentedon Oct 21, 2026
when the official alpine fpm variants built we will release wodby/php, once it's done we will release all images based on this including drupal-php
csandanov commentedon Oct 21, 2026
docker-library/official-images#22541
LvckyAPI commentedon Oct 21, 2026
merged jeah
aeroftiev commentedon Oct 21, 2026
Upstream images are live: https://hub.docker.com/_/php/tagsUpd: seems not available yet, pull fails with "no matching manifest for linux/amd64 in the manifest list entries"
Vacilando commentedon Oct 21, 2026
Still no available update showing for Drupal 11 on the stacks page in Wodby!
csandanov commentedon Oct 21, 2026
we're waiting for fpm alpine variants both arm and amd64, just because PR was merged doesn't mean CI finished building images, we need digests #258
beertje44 commentedon Oct 21, 2026
Would be nice if we could get a final go. I'm seeing updates on hub.docker.com for this project multiple times but after a clean rebuild still old php versions. Would save a lot of bandwidth and frustration I guess :)
csandanov commentedon Oct 21, 2026
r9 release with fixes is out https://github.com/wodby/php/releases/tag/r9
Vacilando commentedon Oct 21, 2026
@csandanov What about the stacks. Eg there is still no new Drupal 11 stack update showing in Wodby - only 6.2.11!
csandanov commentedon Oct 21, 2026
@Vacilando it's coming right up