<![CDATA[⚠️ We have been informed by CERT of an issue affecting PHP:]]>⚠️ We have been informed by CERT of an issue affecting PHP:

https://cert.europa.eu/publications/security-advisories/2026-018 https://www.php.net/archive/2026.php#2026-10-20-1

This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services.

The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.

We will release an update as soon as more information is known about affected PHP versions and availability of updates.

]]>https://forum.fedi.dk/topic/8d2a1f1c-6210-4850-ac5f-63ca2d6044c3/we-have-been-informed-by-cert-of-an-issue-affecting-phpRSS for NodeFri, 23 Oct 2026 04:59:17 GMTWed, 21 Oct 2026 11:44:47 GMT60<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Thu, 22 Oct 2026 14:48:04 GMT]]>@Nextcloud 📱☁️💻 Nextcloud AIO runs in Docker containers. Are these directly affected by the vulnerability, i.e. is it possible to escape and get into the host?]]>https://forum.fedi.dk/post/https://hub.hubzilla.de/item/16271e7c-4ab8-4322-a5a8-8e9064418011https://forum.fedi.dk/post/https://hub.hubzilla.de/item/16271e7c-4ab8-4322-a5a8-8e9064418011Thu, 22 Oct 2026 14:48:04 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Thu, 22 Oct 2026 13:00:00 GMT]]>@mikrobe we will make sure our engineers see this! 🙌

]]>https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117484683298437012https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117484683298437012Thu, 22 Oct 2026 13:00:00 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Thu, 22 Oct 2026 05:28:06 GMT]]>@nextcloud

I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly 👍

]]>https://forum.fedi.dk/post/https://mastodon.social/users/mikrobe/statuses/117482906331480960https://forum.fedi.dk/post/https://mastodon.social/users/mikrobe/statuses/117482906331480960Thu, 22 Oct 2026 05:28:06 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 21:17:11 GMT]]>@Karlitschek @nextcloud @kobold @nextcloud@mastodon.xyz @heinleinsupport

Wieviel 1000 Instanzen sind offline o. noch online wie bspw. freehoster oder viele slfhoster denen ein todo fehlt ?

Aber die Kommunikation eines der größten und zuletzt bei der super gehypten (zu recht?) Players ist mit "Luft nach oben" wohl eher schmeichelhaft charakterisiert, oder wie sieht das Frank?

"Gibt es schon einen voraussichtlichen Termin für die neuen Versionen(...)?"
thx 2 Kobold

cc @qbi

]]>https://forum.fedi.dk/post/https://mastodon.social/users/pflegende/statuses/117480975976966744https://forum.fedi.dk/post/https://mastodon.social/users/pflegende/statuses/117480975976966744Wed, 21 Oct 2026 21:17:11 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 20:28:06 GMT]]>@ligasser @nextcloud After a fresh pull, still 35.0.2, but this time with 'PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:27) (NTS)'. Thanks!

]]>https://forum.fedi.dk/post/https://mastodon.social/users/vsz/statuses/117480782967871415https://forum.fedi.dk/post/https://mastodon.social/users/vsz/statuses/117480782967871415Wed, 21 Oct 2026 20:28:06 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 20:09:49 GMT]]>@vsz @nextcloud https://github.com/nextcloud/docker/issues/2610

]]>https://forum.fedi.dk/post/https://social.epfl.ch/users/ligasser/statuses/117480711101244500https://forum.fedi.dk/post/https://social.epfl.ch/users/ligasser/statuses/117480711101244500Wed, 21 Oct 2026 20:09:49 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 20:02:54 GMT]]>@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...

If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...

]]>https://forum.fedi.dk/post/https://social.epfl.ch/users/ligasser/statuses/117480683864481076https://forum.fedi.dk/post/https://social.epfl.ch/users/ligasser/statuses/117480683864481076Wed, 21 Oct 2026 20:02:54 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 17:58:51 GMT]]>@rello @nextcloud Does not explain why the .1 and .2 where never shipped, so your answer is out of topic

After the update of php we still have the .0, not the .1 or .2, like i said ... second class citizen

]]>https://forum.fedi.dk/post/https://gs.lexinova.eu/users/maya/statuses/01M5FSVBKDEVF60XE8W50KPRXDhttps://forum.fedi.dk/post/https://gs.lexinova.eu/users/maya/statuses/01M5FSVBKDEVF60XE8W50KPRXDWed, 21 Oct 2026 17:58:51 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 17:58:17 GMT]]>@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers

]]>https://forum.fedi.dk/post/https://berlin.social/users/rello/statuses/117480193892111637https://forum.fedi.dk/post/https://berlin.social/users/rello/statuses/117480193892111637Wed, 21 Oct 2026 17:58:17 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 17:57:07 GMT]]>@vsz @nextcloud update still pending. I guess dockerhub is getting challenges a lot right now

]]>https://forum.fedi.dk/post/https://berlin.social/users/rello/statuses/117480189265666087https://forum.fedi.dk/post/https://berlin.social/users/rello/statuses/117480189265666087Wed, 21 Oct 2026 17:57:07 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 17:16:51 GMT]]>I'm on the 34/stable channel
]]>https://forum.fedi.dk/post/https://fedi.meidam.dev/meidam/p/1792603011.722848https://forum.fedi.dk/post/https://fedi.meidam.dev/meidam/p/1792603011.722848Wed, 21 Oct 2026 17:16:51 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 16:59:43 GMT]]>@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/vsz/statuses/117479963616579909https://forum.fedi.dk/post/https://mastodon.social/users/vsz/statuses/117479963616579909Wed, 21 Oct 2026 16:59:43 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 16:43:47 GMT]]>@nextcloud
All docker versions?

]]>https://forum.fedi.dk/post/https://social.linux.pizza/users/killua99/statuses/117479900925346459https://forum.fedi.dk/post/https://social.linux.pizza/users/killua99/statuses/117479900925346459Wed, 21 Oct 2026 16:43:47 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 16:32:31 GMT]]>@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.

]]>https://forum.fedi.dk/post/https://orthographieanarchist.de/users/kobold/statuses/01M5FMX8QEA6DNCBJGNW64YBNMhttps://forum.fedi.dk/post/https://orthographieanarchist.de/users/kobold/statuses/01M5FMX8QEA6DNCBJGNW64YBNMWed, 21 Oct 2026 16:32:31 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 16:27:34 GMT]]>The PHP project has released fixes for the vulnerabilities.

We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.

Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.

Official advisory: https://www.php.net/index.php#2026-10-21-5

]]>https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117479837145502315https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117479837145502315Wed, 21 Oct 2026 16:27:34 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 16:13:54 GMT]]>@shred

yep, that's my observation, too

@nextcloud

]]>https://forum.fedi.dk/post/https://mastodon.de/users/spitfire/statuses/117479783431351338https://forum.fedi.dk/post/https://mastodon.de/users/spitfire/statuses/117479783431351338Wed, 21 Oct 2026 16:13:54 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 15:53:21 GMT]]>@spitfire As of now (15:50 UTC) the nextcloud docker image still runs on vulnerable PHP 8.5.11.

@nextcloud

]]>https://forum.fedi.dk/post/https://troet.cafe/ap/users/117426408733697701/statuses/117479702629798118https://forum.fedi.dk/post/https://troet.cafe/ap/users/117426408733697701/statuses/117479702629798118Wed, 21 Oct 2026 15:53:21 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 14:07:48 GMT]]>@nextcloud No php in mastodon (this web app at least) 🙂

https://github.com/mastodon/mastodon

"Requirements

Ruby 4.0
PostgreSQL 14+
Redis 7.0+
Node.js 24+
FFmpeg 5.1+"

]]>https://forum.fedi.dk/post/https://masto.bike/users/stephavelo/statuses/117479287599336693https://forum.fedi.dk/post/https://masto.bike/users/stephavelo/statuses/117479287599336693Wed, 21 Oct 2026 14:07:48 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 13:50:38 GMT]]>@nextcloud Great, thanks for the reply!

]]>https://forum.fedi.dk/post/https://bildung.social/users/Zengarem/statuses/117479220098615477https://forum.fedi.dk/post/https://bildung.social/users/Zengarem/statuses/117479220098615477Wed, 21 Oct 2026 13:50:38 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 13:35:10 GMT]]>@Zengarem yes!

]]>https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117479159263315098https://forum.fedi.dk/post/https://mastodon.xyz/users/nextcloud/statuses/117479159263315098Wed, 21 Oct 2026 13:35:10 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 13:14:39 GMT]]>@nextcloud Has your website been taken offline accordingly?

]]>https://forum.fedi.dk/post/https://bildung.social/users/Zengarem/statuses/117479078584540309https://forum.fedi.dk/post/https://bildung.social/users/Zengarem/statuses/117479078584540309Wed, 21 Oct 2026 13:14:39 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 12:42:30 GMT]]>@juristi @hetzner @nextcloud Hetzner has an announcement: https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7

]]>https://forum.fedi.dk/post/https://fosstodon.org/users/viktor/statuses/117478952200470515https://forum.fedi.dk/post/https://fosstodon.org/users/viktor/statuses/117478952200470515Wed, 21 Oct 2026 12:42:30 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 12:09:56 GMT]]>@juristi @hetzner @nextcloud Bon ben espérons que les hébergeurs feront leur travail pour tous les sites impactés ... sinon le web dans son ensemble va souffrir !

]]>https://forum.fedi.dk/post/https://mastodon.social/ap/users/115835849032271342/statuses/117478824110062079https://forum.fedi.dk/post/https://mastodon.social/ap/users/115835849032271342/statuses/117478824110062079Wed, 21 Oct 2026 12:09:56 GMT<![CDATA[Reply to ⚠️ We have been informed by CERT of an issue affecting PHP: on Wed, 21 Oct 2026 12:02:35 GMT]]>@hetzner Storage Shares seem still to be up. Any thoughts of following the recommendation, or just hoping for the best?

@nextcloud]]>https://forum.fedi.dk/post/https://fe.disroot.org/objects/579a347b-df8a-491a-a204-b80cd014fca4https://forum.fedi.dk/post/https://fe.disroot.org/objects/579a347b-df8a-491a-a204-b80cd014fca4Wed, 21 Oct 2026 12:02:35 GMT