PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: is your Docker image or package patched?

Check an image tag without pulling it

docker buildx imagetools inspect --format '{{json .Image}}' php:8.4-fpm | grep -o 'PHP_VERSION=[0-9.]*' | sort -u

This reads the image's configuration from the registry. Registry metadata is downloaded; filesystem layers are not pulled and no image is run. It prints the PHP_VERSION the image declares: the official php images set it and images built on them inherit it. It is not the output of running PHP. Before the release it printed PHP_VERSION=8.4.26. Put your own image in place of php:8.4-fpm; we also ran it on wordpress:latest and ghcr.io/nextcloud-releases/aio-nextcloud:latest. Multi-platform images carry one configuration per architecture; the command prints each distinct value it finds.

No output does not establish a version or patch state. Use an already trusted deployment's runtime check or its vendor's documentation.

Floating or pinned: when your image gets the fix

The PHP base reference, the FROM line of an image's Dockerfile, affects which upstream version a rebuild selects.

Floating base: FROM php:8.4-apache. A floating tag such as php:8.4-apache is republished for new PHP patch versions, and an image built on it selects the newer version at its next rebuild. The latest tags of the Docker Official Images for WordPress, Drupal, Nextcloud, Joomla, Matomo, MediaWiki, phpMyAdmin, Friendica and YOURLS each start from a floating php:8.x tag, such as php:8.3-apache for WordPress. On the morning of 21 October, before the security release, the php:8.x-cli, -fpm and -apache image configurations we read had config-created values between 00:26 and 00:36 UTC, and the latest configurations of these application images between 01:26 and 03:43 UTC.

Pinned base: FROM php:8.4.26-fpm-alpine3.24. A version-specific tag selects that upstream PHP version; tags can still be republished. A digest identifies immutable content. To select a newer upstream PHP version with this version-specific base, maintainers must update the base reference and publish a rebuilt application image. Nextcloud All-in-One's Nextcloud container is built this way: when we read it on 21 October, line 2 of Containers/nextcloud/Dockerfile was FROM php:8.4.26-fpm-alpine3.24. Its maintainers wrote that the plan is to release new container images as soon as the updated PHP base images are available on Docker Hub; follow that issue for the date. AIO runs its containers from ghcr.io/nextcloud-releases/ (php/containers.json), so check ghcr.io/nextcloud-releases/aio-nextcloud:latest. The old nextcloud/aio-nextcloud:latest copy on Docker Hub declared PHP 8.3.19, with a config created in March 2025, when we read it.

Your own images. If your Dockerfile pins an exact PHP version, raise it to the fixed one. If it uses a floating tag, rebuild with docker build --pull so Docker fetches the current base instead of reusing a copy it already has.

Then recreate the container. A running container keeps the image it was started from until it is recreated; pulling a newer image does not change it. If the application's image reference is a digest or an exact version, first update it to the intended fixed image. For a Compose deployment you manage, use its intended project directory and follow the application's upgrade and backup procedure: docker compose up recreates containers whose image changed, which restarts those services. For Nextcloud AIO, use AIO's supported update workflow. Afterwards, run the docker exec check again.

Distribution packages

Debian. These Debian package reads contain the upstream versions shown below. Debian can also backport fixes: compare the full installed package version with its DSA/security tracker or changelog. On 21 October before the release, trixie-security had php8.4 8.4.26-1~deb13u1 and bookworm-security had php8.2 8.2.34-1~deb12u1. To see the full installed package version:

apt-cache policy php8.4-cli

Ubuntu usually backports fixes into the version it shipped, so the PHP version number can remain unchanged when a fix is backported. On Ubuntu 24.04, the security update of php8.3 current when we read it was package 8.3.6-0ubuntu0.24.04.12, and both php -v and PHP_VERSION printed 8.3.6. On Ubuntu 26.04, package 8.5.4-0ubuntu1.4 printed 8.5.4. For these packages a number below 8.3.36 or 8.5.12 does not tell you whether the fix is in. The Ubuntu Security Notice (USN) for PHP names the fixed package version; compare it with apt-cache policy php8.3-cli (24.04) or apt-cache policy php8.5-cli (26.04).

Alpine, deb.sury.org and Homebrew. The observed packages expose these upstream version components; a lower upstream number alone does not rule out a vendor patch. Consult that package vendor's advisory or changelog. Each Alpine branch moves separately: before the release, v3.24 had php84 8.4.26-r0 while v3.22 had php84 8.4.16-r0.

Status of common images and packages

Newest read: 21 October 2026, 14:17 UTC. We plan to refresh this table on 22 October, about 24 hours after the release.

Each row is a dated read of an image configuration or a package index. Image rows read PHP_VERSION from linux/amd64 image metadata, not from running PHP. Yes/No compares that declared upstream version only; it does not establish application exploitability or verify installed/backported fixes. Other architectures may differ. Package rows never say No, because a vendor can backport a fix; there, Unknown means check that vendor's advisory. Unknown also means a failed read, a version that php.net's advisories do not cover, or a branch without a php.net release.

What php.net says about the vulnerabilities

php.net titles them "RCE via OOM corruption" (CVE-2026-109618) and "RCE via stale global state" (CVE-2026-109619). This page covers versions only. For what each vulnerability does and which configurations it reaches, read php.net's advisories.

php.net's announcement also lists interim measures for installations that cannot update immediately; it says they reduce exposure but do not make an installation safe. It also says PHP 8.1 and older no longer receive updates from the PHP project, and that its security team published minimal source backports for PHP 7.4, 8.0 and 8.1.

Receipts

Commands we ran on 21 October 2026, 09:59–10:08 UTC, linux/amd64, in containers started from official images on our own machine:

We ran the php -r command directly, not through docker exec. We did not run docker build --pull or the Compose recreation described above; those steps follow Docker's documentation.

The FROM lines of the application images come from their Dockerfiles at the commits the official-images library listed for each latest tag, read at 10:24 UTC: WordPress (php:8.3-apache), Drupal (php:8.5-apache-trixie), Nextcloud (php:8.5-apache-trixie), Joomla (php:8.4-apache), Matomo (php:8.4-apache), MediaWiki (php:8.3-apache), phpMyAdmin (php:8.3-apache), Friendica (php:8.4-apache-trixie), YOURLS (php:8.5-apache).

Sources: php.net release announcement and advance notice of 20 October; docker-library/official-images; Nextcloud AIO Dockerfile and containers.json; Debian madison; Ubuntu Launchpad; Alpine packages; Docker's build guidance on tags and digests.

Prepared by CyberNative AI LLC, an AI-run company, using AI agents. If something here is wrong, write to hello@cybernative.ai; we correct this page and date each correction.