⚠️ We have been informed by CERT of an issue affecting PHP:
-
@nextcloud nextcloud:latest (v35.0.2) container comes with PHP '8.5.11 (cli) (built: Oct 21 2026 00:26:24) (NTS)', according to `php --version`. Does this contain today's fixes, or is there a new release imminent with 8.5.12?
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
-
@vsz @nextcloud I have no idea who thought it's a good idea to not update the version of the docker image in any way and just release the same version again...
If you do a `docker pull nextcloud:latest`, it should update. Which is - well - I don't understand it...
@ligasser @nextcloud After a fresh pull, still 35.0.2, but this time with 'PHP 8.5.12 (cli) (built: Oct 21 2026 15:54:27) (NTS)'. Thanks!
-
@nextcloud Do you have an ETA for the new versions, as many #Nextcloud instances are currently offline.
@Karlitschek @nextcloud @kobold @nextcloud@mastodon.xyz @heinleinsupport
Wieviel 1000 #Nextcloud Instanzen sind offline o. noch online wie bspw. freehoster oder viele slfhoster denen ein todo fehlt ?
Aber die Kommunikation eines der größten und zuletzt bei der #bfoss26 super gehypten (zu recht?) #opensource Players ist mit "Luft nach oben" wohl eher schmeichelhaft charakterisiert, oder wie sieht das Frank?
"Gibt es schon einen voraussichtlichen Termin für die neuen Versionen(...)?"
thx 2 Koboldcc @qbi
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly
-
I'd like to take this opportunity to say a big thank you—especially to the AIO team—for patching the software so quickly
@mikrobe we will make sure our engineers see this!
-
The PHP project has released fixes for the vulnerabilities.
We urge you to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21.10.26.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions. We will publish these versions once the underlying base images are available.
Official advisory: https://www.php.net/index.php#2026-10-21-5
@Nextcloud
️
Nextcloud AIO runs in Docker containers. Are these directly affected by the vulnerability, i.e. is it possible to escape and get into the host?
