Repository navigation
[Bug]: PHP security vulnerability #17
Description
Have you already looked into this bug?
- I have checked the Troubleshooting Guide
- I have checked Release notes for potential migration steps
- I have checked existing issues for similar bugs
- I have googled this bug already with no luck
- I have not done any of the above
(Optional) Error message
No response
What went wrong?
Following the yesterday's security vulnerability announcement published at php.net, could you please kindly push updated PHP docker containers into docker hub?
Expected behaviour
Fixes the php security vulnerability.
How can we reproduce the bug?
No need to reproduce, it is an upstream issue.
Host Operating System
Linux
Host Platform (amd64, arm64, other)
amd64
(Linux only) Is SELinux enabled?
I don't know
Docker version
N/A
Docker Compose version
N/A
Devilbox version
latest
Have you removed stopped containers before starting?
Yes
Have you pulled latest Docker images before starting?
Yes
Devilbox start command
N/A
Config: .env file
N/AConfig: docker-compose.override.yml
N/AConfig: ./check-config.sh
N/ALog: docker-compose logs
N/A(Optional) Additional information
No response
Activity
fibis commentedon Oct 31, 2026
The images in devilbox-community/docker-php-fpm#2 are built on the PHP releases from the 21 October security announcement: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. 8.1.34 is the final 8.1 release (8.1 has been end-of-life since December 2025).
Until the PR is merged and the images are on Docker Hub, the same CI-tested images are public on GHCR:
docker compose pull php && docker compose up -d phpthen gives you the patched release for yourPHP_SERVER. The devilbox side (moving to0.161) is in #18.