You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi, we're trying to rebuild but PECL returns 500 intermittently. Hopefully we can publish fixed images soon. This will only apply to 8.2 and above, however...
Images tagged 8.2-8.5 are up to date with the latest official patches.
Build for :latest and :alpine have failed — I relaunched them, but it will take another while before they're ready. Apologize for the delays… 😞
Any chance the php7.4-apache image will be rebuild? Would be very gratefull on behalf of muziekweb.nl (currently offline), the Dutch public music library...
@frankstrater Careful! The 7.4 rebuilt image does not include the security patch! It was not released on the base image we build upon. @le0m is still working to bring the patched version on images ≤ 8.2
@le0m Is there any way to speed up this work at Chialab? Does Chialab accept monetary donations from other European cultural institutes? Or personal donations?
@frankstrater Thank you, but it's not needed… unless "personal donations" include weekends in the Netherlands with a free guided tour of the Dutch public music library. 😂
We're working on this as a priority anyway.
Just to keep you posted: we have investigated what options we have right now for PHP versions that are EoL.
We could use a newer Debian base image and install PHP from ondrej repositories, but that could cause issues with unexpected OS updates that might break things in more or less subtle ways, and paths where PHP config files should be placed would change. We could work around this with a bunch of symlinks… but it feels an unstable solution to us, and end users might see their build start failing, or worse.
We have thus decided to build from source using the same base image, and apply backported patches from the Debian backports: https://salsa.debian.org/php-team/php
This allows us to keep the same base Debian image, which should cause less issues with backward compatibility, and hopefully this will be less painful for those who build upon these images — ourselves in primis.
This might take a bit longer, but should be a more stable solution.
I'll stay in touch through email @chialab and see what we can do to express our gratitude at the Netherlands Institute for Sound and Vision (NISV) / Muziekweb.nl / Fonos. (the new location is under construction, see: https://www.beeldengeluid.nl/fonos )
As fquffio explained, we decided to start building EOL PHP versions from source, so that we could apply the Debian backported patches. We tested the new images and didn't find any regressions, but please run your own tests before deploying in production 😉
We decided to initially apply only the patches specific for CVE-2026-109618 and CVE-2026-109619 to speed up the release, but we'll now start adding the other security patches as well.
@adlanarifzr The :latest, :alpine, and the 8.2-8.5 versions were already patched as of Thursday in the early morning (UTC).
For the 5.6-8.1 images to be patched, we had to rebuild PHP from source using the Debian patches backports, and those have been published a few minutes ago, after #140 got merged!
The -compat flavor is still being built, so that's the only variant that is still unsafe.
Beware that most vulnerability scanners rely on the reported PHP version (php -v) to detect if they are vulnerable or not. Our images do not change this, so they appear as still vulnerable. We specifically added a PHP_PATCHES env variable and a it.chialab.php.patches docker label to differentiate patched images from unpatched ones.
Activity
fquffio commentedon Oct 21, 2026
Hi, we're trying to rebuild but PECL returns 500 intermittently. Hopefully we can publish fixed images soon. This will only apply to 8.2 and above, however...
dpacmittal commentedon Oct 21, 2026
Thank you for the update. I'm aware that it only applies to 8.2+.
fquffio commentedon Oct 22, 2026
Images tagged 8.2-8.5 are up to date with the latest official patches.
Build for
:latestand:alpinehave failed — I relaunched them, but it will take another while before they're ready. Apologize for the delays… 😞frankstrater commentedon Oct 22, 2026
Any chance the php7.4-apache image will be rebuild? Would be very gratefull on behalf of muziekweb.nl (currently offline), the Dutch public music library...
Edit: I see it's just been published. Thank you.
fquffio commentedon Oct 22, 2026
@frankstrater Careful! The 7.4 rebuilt image does not include the security patch! It was not released on the base image we build upon. @le0m is still working to bring the patched version on images ≤ 8.2
frankstrater commentedon Oct 22, 2026
Ah ok, thanks for the heads up. I'll patiently wait, but will test this specifc version anyway.
frankstrater commentedon Oct 22, 2026
@le0m Is there any way to speed up this work at Chialab? Does Chialab accept monetary donations from other European cultural institutes? Or personal donations?
fquffio commentedon Oct 22, 2026
@frankstrater Thank you, but it's not needed… unless "personal donations" include weekends in the Netherlands with a free guided tour of the Dutch public music library. 😂
We're working on this as a priority anyway.
Just to keep you posted: we have investigated what options we have right now for PHP versions that are EoL.
We could use a newer Debian base image and install PHP from
ondrejrepositories, but that could cause issues with unexpected OS updates that might break things in more or less subtle ways, and paths where PHP config files should be placed would change. We could work around this with a bunch of symlinks… but it feels an unstable solution to us, and end users might see their build start failing, or worse.We have thus decided to build from source using the same base image, and apply backported patches from the Debian backports: https://salsa.debian.org/php-team/php
This allows us to keep the same base Debian image, which should cause less issues with backward compatibility, and hopefully this will be less painful for those who build upon these images — ourselves in primis.
This might take a bit longer, but should be a more stable solution.
@le0m is working on this in #140
frankstrater commentedon Oct 23, 2026
@fquffio @le0m Grazie mille!
I'll stay in touch through email @chialab and see what we can do to express our gratitude at the Netherlands Institute for Sound and Vision (NISV) / Muziekweb.nl / Fonos. (the new location is under construction, see: https://www.beeldengeluid.nl/fonos )
le0m commentedon Oct 23, 2026
@frankstrater Sorry for the long delay 🙏🏼
As fquffio explained, we decided to start building EOL PHP versions from source, so that we could apply the Debian backported patches. We tested the new images and didn't find any regressions, but please run your own tests before deploying in production 😉
We decided to initially apply only the patches specific for CVE-2026-109618 and CVE-2026-109619 to speed up the release, but we'll now start adding the other security patches as well.
adlanarifzr commentedon Oct 23, 2026
@le0m Thanks for the updates! Is that meant we can pull latest image now and it already patches the CVE-2026-109618 and CVE-2026-109619 ?
fquffio commentedon Oct 23, 2026
@adlanarifzr The
:latest,:alpine, and the 8.2-8.5 versions were already patched as of Thursday in the early morning (UTC).For the 5.6-8.1 images to be patched, we had to rebuild PHP from source using the Debian patches backports, and those have been published a few minutes ago, after #140 got merged!
The
-compatflavor is still being built, so that's the only variant that is still unsafe.le0m commentedon Oct 23, 2026
Beware that most vulnerability scanners rely on the reported PHP version (
php -v) to detect if they are vulnerable or not. Our images do not change this, so they appear as still vulnerable. We specifically added aPHP_PATCHESenv variable and ait.chialab.php.patchesdocker label to differentiate patched images from unpatched ones.