rewindex

ChangesChainguardCritical PHP vulnerabilities require updates

Chainguard: Incident silently edited: Critical PHP vulnerabilities require updates

Silent editNormal progress (typesafe/jev-1.13-20260917, 82%)Changed
Summary

Chainguard marked its critical PHP vulnerability incident resolved at 2026-10-22 22:52 UTC, changing the vendor status from degraded to resolved. Updated images reached all customer registries, using patched official PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the earlier patched PHP and matching frankenphp packages remain valid fixes. Start time and duration were not provided.

Machine-written from the diff below (Sol; type: incident edit). Check the diff before relying on it.

Incident page: the full timeline of updates

What changed

Struck in red is what Chainguard removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: ongoing
After: resolved
AddedResolved time#2
Before: not present
After: 2026-10-22 22:52 UTC
ChangedUpdatedegraded → resolved#3
Before: Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.
After: Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.

Compared with the previous archived version of this incident (10 to 30-minute polling).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Friday, October 23

1 rewrite

Thursday, October 22

1 incident change

All Chainguard changesChainguard profileMarkdownJSON