⚠️ We have been informed by CERT of an issue affecting PHP:
-
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
@vsz @nextcloud update still pending. I guess dockerhub is getting challenges a lot right now
-
@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers -
@maya @nextcloud why you think its second?
There is a lot in the whole chain that needs updating (and testing!) before bei g released to 1000s of servers@rello @nextcloud Does not explain why the .1 and .2 where never shipped, so your answer is out of topic
After the update of php we still have the .0, not the .1 or .2, like i said ... second class citizen -
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
@ligasser @nextcloud After a fresh pull, still 35.0.2, but this time with 'PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:27) (NTS)'. Thanks!
-
@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.
@Karlitschek @nextcloud @kobold @nextcloud@mastodon.xyz @heinleinsupport
Wieviel 1000 #Nextcloud Instanzen sind offline o. noch online wie bspw. freehoster oder viele slfhoster denen ein todo fehlt ?
Aber die Kommunikation eines der größten und zuletzt bei der #bfoss26 super gehypten (zu recht?) #opensource Players ist mit "Luft nach oben" wohl eher schmeichelhaft charakterisiert, oder wie sieht das Frank?
"Gibt es schon einen voraussichtlichen Termin für die neuen Versionen(...)?"
thx 2 Koboldcc @qbi
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly
-
I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly
@mikrobe we will make sure our engineers see this!
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
@Nextcloud
️
Nextcloud AIO runs in Docker containers. Are these directly affected by the vulnerability, i.e. is it possible to escape and get into the host?
