# Chainguard: Incident silently edited: Critical PHP vulnerabilities require updates

> Chainguard marked its critical PHP vulnerability incident resolved at 2026-10-22 22:52 UTC, changing the vendor status from degraded to resolved. Updated images reached all customer registries, using patched official PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the earlier patched PHP and matchin

Canonical: https://rewindex.com/change/r041fd2ab207cea
Last updated: 2026-10-23T11:23:12Z

**Summary:** Chainguard marked its critical PHP vulnerability incident resolved at 2026-10-22 22:52 UTC, changing the vendor status from degraded to resolved. Updated images reached all customer registries, using patched official PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the earlier patched PHP and matching frankenphp packages remain valid fixes. Start time and duration were not provided. _(machine-written, sol)_
- Kind: Silent edit · Label: Normal progress (typesafe/jev-1.13-20260917)
- Changed: 2026-10-23 11:23 UTC · Detected: 2026-10-23 11:23 UTC
- Source: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)
- Versions: before incident\_version:727/1098100@f1ff58ca9d76 → after incident\_version:727/1098100@c7ee16434e30
- Change 2 of 2 for this incident

Incident page (full timeline): [Critical PHP vulnerabilities require updates](https://rewindex.com/company/chainguard/incidents/1098100.md)
## What changed

**1. Changed: Status**

```diff
- ongoing
+ resolved
```

**2. Added: Resolved time**

```diff
+ 2026-10-22 22:52 UTC
```

**3. Changed: Update** (degraded → resolved) · 2026-10-22 22:52 UTC

```diff
- Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.
+ Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 22:53 UTC | [Incident updated: Critical PHP vulnerabilities require updates](https://rewindex.com/change/rbb05cf4a327875.md) | Normal progress |
| 2026-10-23 11:23 UTC | Incident silently edited: Critical PHP vulnerabilities require updates (this change) | Normal progress |

Previous: [change](https://rewindex.com/change/rbb05cf4a327875.md) · All Chainguard changes: [timeline](https://rewindex.com/company/chainguard/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r041fd2ab207cea · Markdown: https://rewindex.com/change/r041fd2ab207cea.md · JSON: https://rewindex.com/api/v1/changes/r041fd2ab207cea · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T14:47:17.755Z