⚠️ We have been informed by CERT of an issue affecting PHP:
-
️ We have been informed by CERT of an issue affecting PHP:https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
@hetzner Storage Shares seem still to be up. Any thoughts of following the recommendation, or just hoping for the best?
@nextcloud -
@hetzner Storage Shares seem still to be up. Any thoughts of following the recommendation, or just hoping for the best?
@nextcloud@juristi @hetzner @nextcloud Bon ben espérons que les hébergeurs feront leur travail pour tous les sites impactés ... sinon le web dans son ensemble va souffrir !
-
S strit@mastodon.social shared this topic
-
@hetzner Storage Shares seem still to be up. Any thoughts of following the recommendation, or just hoping for the best?
@nextcloud@juristi @hetzner @nextcloud Hetzner has an announcement: https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7
-
️ We have been informed by CERT of an issue affecting PHP:
https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
@nextcloud Has your website been taken offline accordingly?
-
@nextcloud Has your website been taken offline accordingly?
@Zengarem yes!
-
@nextcloud Great, thanks for the reply!
-
️ We have been informed by CERT of an issue affecting PHP:
https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
@nextcloud No php in mastodon (this web app at least)
https://github.com/mastodon/mastodon
"Requirements
Ruby 4.0
PostgreSQL 14+
Redis 7.0+
Node.js 24+
FFmpeg 5.1+" -
@nextcloud So I assume the docker-images you provide will get their updates transparrently because they are based on the debian base image? would an image-pull at a later date suffice to get those fixes, too?
@spitfire As of now (15:50 UTC) the nextcloud docker image still runs on vulnerable PHP 8.5.11.
-
@spitfire As of now (15:50 UTC) the nextcloud docker image still runs on vulnerable PHP 8.5.11.
-
️ We have been informed by CERT of an issue affecting PHP:
https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
-
A anderslund@expressional.social shared this topic
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
@nextcloud
All docker versions? -
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
-
️ We have been informed by CERT of an issue affecting PHP:
https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
I tried doing a refresh of the nextcloud snap package again now, and seems like there was an update today. So I imagine that means that the php issue has been addressed in that upgrade. Right?
I'm on the 34/stable channel
-
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
@vsz @nextcloud update still pending. I guess dockerhub is getting challenges a lot right now
-
@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers -
@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers@rello @nextcloud Does not explain why the .1 and .2 where never shipped, so your answer is out of topic
After the update of php we still have the .0, not the .1 or .2, like i said ... second class citizen -
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
@ligasser @nextcloud After a fresh pull, still 35.0.2, but this time with 'PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:27) (NTS)'. Thanks!
