Chainguard, Inc. Incident History

1. degradedOct 21 · 22:08 UTC

   Updated Oct 21, 2026 at 4:40pm CDT Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21 at 14:00 UTC. Patched Chainguard packages and images are available now. We recommend you pull and redeploy any image that includes PHP 8.2 through 8.5. You're patched if your image has php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4 or php-8.5 8.5.11-r4 or later (frankenphp: 8.2.34-r3, 8.3.35-r2, 8.4.26-r2, 8.5.11-r2). The official 8.2.35, 8.3.36, 8.4.27 and 8.5.12 releases are also patched. Images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, phpmyadmin, zabbix, renovate, privatebin and moodle, have been rebuilt with these versions. An earlier incident delayed image sync for some customer registries; as of 16:48 UTC every customer registry has the fixed standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips), and most images that bundle PHP have synced. A small number of custom images are still being updated. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds, so refresh your scanner to clear patched images. For how to check your image's SBOM and update, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry doesn't have the fixed version, contact Support. Next update by October 22, 16:00 UTC.

Reported by Chainguard, Inc. on their status page.

1. degradedOct 21 · 18:30 UTC

   Updated Oct 21, 2026 at 1:05pm CDT Sync of updated images to customer registries continues. As of 17:51 UTC, 96.5% of the image tags customers actively sync carry the new certificate bundle (ca-certificates-bundle 20260909-r3), up from 95% at 16:06 UTC. We recommend you pull and redeploy now to pick up every updated image already in your registry. We have increased sync capacity, and based on current rates we expect the remaining images to reach customer registries within the next few hours, ahead of our earlier estimate of October 23, 02:00 UTC. We'll notify you when the sync is complete, so you can pull and redeploy again. A small number of repositories, including pytorch, pytorch-fips and os-shell-iamguarded, have not yet synced. If you pull one of these and still see an older bundle version, check again shortly. Fixes for applications that bundle their own certificates continue to land: the uv fix for Python is merged, gRPC fixes are merged for several images and in progress for the rest, and Node.js is covered in the remediation guide. For steps to update, confirm the fix, and handle applications that bundle their own certificates, see the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 22, 02:00 UTC.

Reported by Chainguard, Inc. on their status page.

1. resolvedOct 8 · 14:30 UTC

   Maintenance ended

Reported by Chainguard, Inc. on their status page.

1. resolvedOct 16 · 20:32 UTC

   This issue has been resolved. The OpenSSL 4 transition is complete, all Chainguard images and packages are now on OpenSSL 4, and our services are operating normally. Customers whose builds mix OpenSSL 3 and OpenSSL 4, or who run prebuilt software that still needs the OpenSSL 3 libraries, have been contacted directly with migration steps and a hardened OpenSSL 3.5 option.

   For full details, see our knowledge base article: KB: OpenSSL 4 transition complete and a hardened OpenSSL 3.5 option

Reported by Chainguard, Inc. on their status page.

1. resolvedOct 1 · 18:58 UTC

   The issue has been resolved. Packages and images are now being published as expected.

Reported by Chainguard, Inc. on their status page.

1. resolvedSep 29 · 12:44 UTC

   Maintenance is complete.

Reported by Chainguard, Inc. on their status page.