New PHP Vulnerability CVE-2026-115560 #2615

Activity

1. Flauschbaellchen commented on Oct 23, 2026

   

   Flauschbaellchen

   on Oct 23, 2026

   More actions

   To be sure, you may check the PHP version used by your image yourself by open a shell to it and call:

   # php --version
   

   Something similar as the following should show up:

   PHP 8.5.11 (cli) (built: Oct  6 2026 01:23:10) (NTS)
   Copyright (c) The PHP Group
   Built by https://github.com/docker-library/php
   Zend Engine v4.5.11, Copyright (c) Zend Technologies
       with Zend OPcache v8.5.11, Copyright (c), by Zend Technologies
   

   I've pulled/updated the image and now it returns:

   PHP 8.5.12 (cli) (built: Oct 21 2026 15:49:40) (NTS)
   Copyright (c) The PHP Group
   Built by https://github.com/docker-library/php
   Zend Engine v4.5.12, Copyright (c) Zend Technologies
       with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies
   

   As of https://cert.europa.eu/publications/security-advisories/2026-018 PHP 8.5 versions prior to 8.5.12 are affected.
2. alper-d commented on Oct 23, 2026

   

   alper-d

   on Oct 23, 2026

   Author

   More actions

   To be on the same page, this is a new vulnerability, not the ones from October 21.
3. joshtrichards commented on Oct 23, 2026

   

   joshtrichards

   on Oct 23, 2026

   Member

   More actions

   Already dealt with and merged (pending image updates/builds): #2614
4. joshtrichards

   closed this as completedon Oct 23, 2026
5. inittux111 commented on Oct 23, 2026

   

   inittux111

   on Oct 23, 2026

   More actions

   The PHP blog was updated today, they mention that it's still a good idea to disable upload_progress.enabled "to fully protect from an unlikely RCE vector".
   https://www.php.net/archive/2026.php#2026-10-23-1

   podman exec nextcloud php -i | grep upload_progress.enabled
   session.upload_progress.enabled => On => On