Struck in red is what Chainguard removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
AddedUpdatedegraded#1
Before: not present
After: Updated Oct 22, 2026 at 5:30pm CDT
Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now.
Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages.
To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.
Compared with the previous archived version of this incident (10 to 30-minute polling).
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Chainguard marked its critical PHP vulnerability incident resolved at 2026-10-22 22:52 UTC, changing the vendor status from degraded to resolved. Updated images reached all customer registries, using patched official PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the earlier patched PHP and matching frankenphp packages remain valid fixes. Start time and duration were not provided.