⚠️ We have been informed by CERT of an issue affecting PHP:

[stephavelo@masto.bike]

@nextcloud No php in mastodon (this web app at least)

https://github.com/mastodon/mastodon

"Requirements

Ruby 4.0
PostgreSQL 14+
Redis 7.0+
Node.js 24+
FFmpeg 5.1+"

[shred@troet.cafe]

@spitfire As of now (15:50 UTC) the nextcloud docker image still runs on vulnerable PHP 8.5.11.

@nextcloud

[spitfire@mastodon.de]

@shred

yep, that's my observation, too

@nextcloud

[nextcloud@mastodon.xyz]

The PHP project has released fixes for the vulnerabilities.

We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.

Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.

Official advisory: https://www.php.net/index.php#2026-10-21-5

[kobold@orthographieanarchist.de]

@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.

[killua99@social.linux.pizza]

@nextcloud
All docker versions?

[vsz@mastodon.social]

@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?

[meidam@fedi.meidam.dev]

I tried doing a refresh of the nextcloud snap package again now, and seems like there was an update today. So I imagine that means that the php issue has been addressed in that upgrade. Right?
I'm on the 34/stable channel

[rello@berlin.social]

@vsz @nextcloud update still pending. I guess dockerhub is getting challenges a lot right now

[rello@berlin.social]

@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers

[maya@gs.lexinova.eu]

@rello @nextcloud Does not explain why the .1 and .2 where never shipped, so your answer is out of topic

After the update of php we still have the .0, not the .1 or .2, like i said ... second class citizen

[ligasser@social.epfl.ch]

@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...

If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...

[ligasser@social.epfl.ch]

@vsz @nextcloud https://github.com/nextcloud/docker/issues/2610

[vsz@mastodon.social]

@ligasser @nextcloud After a fresh pull, still 35.0.2, but this time with 'PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:27) (NTS)'. Thanks!

[pflegende@mastodon.social]

@Karlitschek @nextcloud @kobold @nextcloud@mastodon.xyz @heinleinsupport

Wieviel 1000 #Nextcloud Instanzen sind offline o. noch online wie bspw. freehoster oder viele slfhoster denen ein todo fehlt ?

Aber die Kommunikation eines der größten und zuletzt bei der #bfoss26 super gehypten (zu recht?) #opensource Players ist mit "Luft nach oben" wohl eher schmeichelhaft charakterisiert, oder wie sieht das Frank?

"Gibt es schon einen voraussichtlichen Termin für die neuen Versionen(...)?"
thx 2 Kobold

cc @qbi

[mikrobe@mastodon.social]

@nextcloud

#nextcloud #nextcloudaio #php

I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly

[nextcloud@mastodon.xyz]

@mikrobe we will make sure our engineers see this!

[borsti67@hub.hubzilla.de]

@Nextcloud ️ Nextcloud AIO runs in Docker containers. Are these directly affected by the vulnerability, i.e. is it possible to escape and get into the host?