[aegis123]

Bumps the PHP 8.2–8.5 base images to the 21 Oct 2026 PHP security release, which fixes two critical unauthenticated remote code execution vulnerabilities affecting PHP-FPM:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via OOM corruption
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state

References:

• PHP security advisory: https://www.php.net/archive/2026.php
• https://nvd.nist.gov/vuln/detail/cve-2026-109618
• https://nvd.nist.gov/vuln/detail/cve-2026-109619

File	Old	New
php/8.2/Dockerfile	php:8.2.34-fpm	php:8.2.35-fpm
php/8.3/Dockerfile	php:8.3.35-fpm	php:8.3.36-fpm
php/8.4/Dockerfile	php:8.4.26-fpm	php:8.4.27-fpm
php/8.5/Dockerfile	php:8.5.11-fpm	php:8.5.12-fpm

PHP 8.1 is EOL and received no upstream release, so php/8.1 is unchanged.

Only the FROM line changes. Verified each new official image runs and reports the expected PHP_VERSION (amd64).

After merge: maintainers need to tag a release to publish easyengine/php8.x images, then bump img-versions.json in EasyEngine/easyengine to the new tag.

🤖 Generated with Claude Code

[mrrobot47]

Thanks for putting this together! These exact bumps are already merged into develop as separate PRs: #362 (8.5.12), #363 (8.4.27), #364 (8.3.36) and #365 (8.2.35). The patched images will be published with the upcoming v4.13.3 release, so I'm closing this one as a duplicate.

[mrrobot47]

A note on timing, since the merged bumps haven't been published as images yet: pecl.php.net has been returning HTTP 500 errors for most extension downloads (memcached, redis, imagick, apcu, timezonedb and others) since about 16:40 UTC today, likely from the load of everyone rebuilding PHP images after the security release. Our PHP images install these extensions from pecl during the build, and a build during the outage completes but produces images missing them. So we're holding the v4.13.3 tag, which publishes the images, until pecl is stable again, and we'll verify every published image before the EasyEngine release goes out. Until then, the steps in https://easyengine.io/blog/upcoming-php-security-release-easyengine/ reduce exposure in the meantime.

[mrrobot47]

Update: the patched images are now published. The dockerfiles v4.13.3 tag shipped easyengine/php8.2, php8.3, php8.4 and php8.5:v4.13.3 with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. We checked each one before release: the right PHP version and every extension present. EasyEngine v4.13.3 moves existing sites onto them with ee cli update: https://github.com/EasyEngine/easyengine/releases/tag/v4.13.3. Release post: https://easyengine.io/blog/easyengine-v4-13-3-php-security-update/. Thanks again for raising this!