Emergency release for CVE-2026-109618 & CVE-2026-109619?

[Offlein]

Update

👉 See this thread for official updates:

• Critical PHP security release 2026-10-21 (CVE-2026-109618, CVE-2026-109619) #721

Original Post

Hello,

There is a critical security vulnerability being patched in PHP versions 8.2 and beyond tomorrow (October 21) at 14:00 UTC.

PHP is not releasing any technical details about this except that it patches a remote code execution bug and is rated a CVSS 4.0 9.2.

They are expecting that as soon as the patch is released, it will likely trigger malicious actors to reverse-engineer the exploit and start probing servers for vulnerabilities ASAP.

It would be great to know if our serversideup images might pick up these upstream patches as an emergency release which we can pull soon after 14:00 UTC.

Is there any chance of this?

Thank you!

[jaydrogers]

Already on top of it 🤓

• https://x.com/jaydrogers/status/2112634469450727494

I have it in my calendar to update this as soon as the official Docker PHP images are built.

[Offlein]

OK, that's great, Jay - thank you so much!

Assuming it goes out right "on time", is this the sort of thing where you'll need like an hour or more to get it ready and release it on your side? or like... A few minutes? Or something in between?

We're debating whether to take our system offline per CERT-EU's advisement: Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. But of course that's dollars lost. :(

[lotfiouss]

Thanks

Just to confirm, will PHP 8.2 images also receive the security update? We're currently using PHP 8.2 and want to make sure it will be included in the rebuild.

Thanks

[jaydrogers]

Thanks for opening this. I created another thread to keep everyone updated.

👉 Subscribe to this thread for the latest updates: #721