# Chainguard: Incident updated: Critical PHP vulnerabilities require updates

> Incident updated: Critical PHP vulnerabilities require updates. Detected 2026-10-22 by Rewindex: what changed on Chainguard’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/rbb05cf4a327875
Last updated: 2026-10-22T22:53:04Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-22 22:53 UTC · Detected: 2026-10-22 22:53 UTC
- Source: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)
- Versions: before incident\_version:727/1098100@cc35c07bd6f5 → after incident\_version:727/1098100@f1ff58ca9d76
- Change 1 of 2 for this incident

Incident page (full timeline): [Critical PHP vulnerabilities require updates](https://rewindex.com/company/chainguard/incidents/1098100.md)
## What changed

**1. Added: Update** (degraded) · 2026-10-22 22:52 UTC

```diff
+ Updated Oct 22, 2026 at 5:30pm CDT Updated PHP images have been delivered to all customer registries. All Chainguard PHP images are now built on the official PHP releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier packages (php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4, php-8.5 8.5.11-r4, and the matching frankenphp packages) contain the same fix, so an image on either set of versions is patched. This covers the standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips) and the images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, zabbix, renovate, privatebin and moodle. If you have not pulled and redeployed since October 21, do so now. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds; if your scanner still flags a patched image, refresh its feed and scan again. If you use Custom Assembly and your configuration pins PHP package versions, the pins block the update — update or remove them and the image will rebuild on the fixed packages. To check your image's SBOM and update it, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry still doesn't have a fixed version, contact Support. Next update by October 23, 16:00 UTC.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 22:53 UTC | Incident updated: Critical PHP vulnerabilities require updates (this change) | Normal progress |
| 2026-10-23 11:23 UTC | [Incident silently edited: Critical PHP vulnerabilities require updates](https://rewindex.com/change/r041fd2ab207cea.md) | Normal progress |

Next: [change](https://rewindex.com/change/r041fd2ab207cea.md) · All Chainguard changes: [timeline](https://rewindex.com/company/chainguard/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/rbb05cf4a327875 · Markdown: https://rewindex.com/change/rbb05cf4a327875.md · JSON: https://rewindex.com/api/v1/changes/rbb05cf4a327875 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T15:33:09.001Z