Chainguard, Inc. Status

Critical PHP vulnerabilities require updates

Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.