# Chainguard: Critical PHP vulnerabilities require updates

- Impact (vendor’s label): minor
- Status: ongoing
- Started: 2026-10-21 22:08 UTC · Resolved: not resolved · Duration: ongoing
- Updates: 1 · Affected components: Image builds & releases
- Vendor status page: n/a
- [Company: Chainguard](https://rewindex.com/company/chainguard.md)

## Timeline of updates

- **degraded** 2026-10-21 22:08 UTC: Updated Oct 21, 2026 at 4:40pm CDT Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed by the PHP project on October 21 at 14:00 UTC. Patched Chainguard packages and images are available now. We recommend you pull and redeploy any image that includes PHP 8.2 through 8.5. You're patched if your image has php-8.2 8.2.34-r4, php-8.3 8.3.35-r4, php-8.4 8.4.26-r4 or php-8.5 8.5.11-r4 or later (frankenphp: 8.2.34-r3, 8.3.35-r2, 8.4.26-r2, 8.5.11-r2). The official 8.2.35, 8.3.36, 8.4.27 and 8.5.12 releases are also patched. Images that bundle PHP, including wordpress, drupal, laravel, nextcloud-server, adminer, phpmyadmin, zabbix, renovate, privatebin and moodle, have been rebuilt with these versions. An earlier incident delayed image sync for some customer registries; as of 16:48 UTC every customer registry has the fixed standard PHP images (php, php-fips, frankenphp, phpmyadmin, phpmyadmin-fips), and most images that bundle PHP have synced. A small number of custom images are still being updated. Both CVEs are listed as fixed in the Chainguard and Wolfi security feeds, so refresh your scanner to clear patched images. For how to check your image's SBOM and update, including Custom Assembly and digest-pinned images, see the knowledge base article: https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619. If an image in your registry doesn't have the fixed version, contact Support. Next update by October 22, 16:00 UTC.


---
Canonical: https://rewindex.com/company/chainguard/incidents/1098100 · Markdown: https://rewindex.com/company/chainguard/incidents/1098100.md · JSON: https://rewindex.com/api/v1/companies/chainguard/incidents/1098100 · Generated 2026-10-22T00:32:42.549Z