⚠️ We have been informed by CERT of an issue affecting PHP:

[nextcloud@mastodon.xyz]

️ We have been informed by CERT of an issue affecting PHP:

https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1

This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.

The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.

We will release an update as soon as more information is known about affected PHP versions and availability of updates.

[oldperl@mastodon.online]

@nextcloud
Thx

CC @Chaotica
CC @selfhtml

#php2shell #nextcloud #webadmin #serveradmin #security #php

[spitfire@mastodon.de]

@nextcloud So I assume the docker-images you provide will get their updates transparrently because they are based on the debian base image? would an image-pull at a later date suffice to get those fixes, too?

[juristi@fe.disroot.org]

@hetzner Storage Shares seem still to be up. Any thoughts of following the recommendation, or just hoping for the best?

@nextcloud

[jipexu@mastodon.social]

@juristi @hetzner @nextcloud Bon ben espérons que les hébergeurs feront leur travail pour tous les sites impactés ... sinon le web dans son ensemble va souffrir !

[viktor@fosstodon.org]

@juristi @hetzner @nextcloud Hetzner has an announcement: https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

[zengarem@bildung.social]

@nextcloud Has your website been taken offline accordingly?

[nextcloud@mastodon.xyz]

@Zengarem yes!

[zengarem@bildung.social]

@nextcloud Great, thanks for the reply!

[stephavelo@masto.bike]

@nextcloud No php in mastodon (this web app at least)

https://github.com/mastodon/mastodon

"Requirements

Ruby 4.0
PostgreSQL 14+
Redis 7.0+
Node.js 24+
FFmpeg 5.1+"

[shred@troet.cafe]

@spitfire As of now (15:50 UTC) the nextcloud docker image still runs on vulnerable PHP 8.5.11.

@nextcloud

[spitfire@mastodon.de]

@shred

yep, that's my observation, too

@nextcloud

[nextcloud@mastodon.xyz]

The PHP project has released fixes for the vulnerabilities.

We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.

Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.

Official advisory: https://www.php.net/index.php#2026-10-21-5

[kobold@orthographieanarchist.de]

@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.

[killua99@social.linux.pizza]

@nextcloud
All docker versions?

[vsz@mastodon.social]

@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?

[meidam@fedi.meidam.dev]

I tried doing a refresh of the nextcloud snap package again now, and seems like there was an update today. So I imagine that means that the php issue has been addressed in that upgrade. Right?
I'm on the 34/stable channel

[rello@berlin.social]

@vsz @nextcloud update still pending. I guess dockerhub is getting challenges a lot right now

[rello@berlin.social]

@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers

[maya@gs.lexinova.eu]

@rello @nextcloud Does not explain why the .1 and .2 where never shipped, so your answer is out of topic

After the update of php we still have the .0, not the .1 or .2, like i said ... second class citizen