High severity CVE in PHP CVE-2026-109618/109619, should be fixed in 8.5.12

Hey, there is high severity CVE in PHP (https://www.php.net/index.php#2026-10-20-1) which is used in zabbix 7.x docker image, also in latest i.e. 7.0.32. Are there any plans to remediate by update the baseimage with php patched, shall provide the PR?

Any news about this? For the moment, the only solution I found was to filter through Caddy, but it’s not a definitive solution… Does anyone know when the patch for the new PHP version in Zabbix will be available?

all latest images will be rebuilt today.

@dotneft

@dotneft Will the numbered version images (7.0.32) will be rebuilt too or are you planning on pushing a 7.0.33 version today ? We avoid using the -latest images and so far it seems to be the only one being rebuilt (And from your answer I get that it might be the only one getting rebuilt). Thank you !

I just checked the images zabbix/zabbix-web-nginx-mysql:alpine-7.0.32 and zabbix/zabbix-web-nginx-mysql:alpine-7.0-latest
zabbix/zabbix-web-nginx-mysql:alpine-7.0.32
contains zabbix version 7.0.32
and php 8.5.11
while zabbix/zabbix-web-nginx-mysql:alpine-7.0-latest
contains zabbix version 7.0.32
and php 8.5.12
What are the plans with this ? I assume this is not correct.

FWIW, the alpine image for 7.4 seems to be updated:

$ docker pull zabbix/zabbix-web-nginx-mysql:alpine-7.4-latest
alpine-7.4-latest: Pulling from zabbix/zabbix-web-nginx-mysql
Digest: sha256:adcdbc2ca0bfa8269ee9769e5bd9a85d81adf886403db302d2b0d15fdba50e37
Status: Image is up to date for zabbix/zabbix-web-nginx-mysql:alpine-7.4-latest
docker.io/zabbix/zabbix-web-nginx-mysql:alpine-7.4-latest

$ docker run --rm zabbix/zabbix-web-nginx-mysql:alpine-7.4-latest apk list --installed | grep php85-common
php85-common-8.5.12-r0 aarch64 {php85} (PHP-3.01 BSD-3-Clause LGPL-2.0-or-later MIT Zend-2.0 Apache-2.0) [installed]

The Docker Image for Alpine (7.4.16-alpine) was pushed on 20.10. 5:29 UTC while the updated Alpine package was only released on 21.10 14:29 UTC (I think UTC)
https://pkgs.alpinelinux.org/package/v3.24/community/x86_64/php85-fpm

Maybe it would be cleaner to do a full no-feature change patch version bump?

ol-7.0.32 needs to be updated too

[upd] ol-7.0.32 also rebuilded and have 8.3.36 patched php-fpm version. thx

It seems the latest zabbix-web-apache-pgsql [7.0.32-ubuntu][sha256-562b70986134] were again built with v8.5.4.
zabbix@f4b6aaa18df2:/usr/share/zabbix$ /usr/sbin/php-fpm8.5 -v PHP 8.5.4 (fpm-fcgi) (built: Oct 19 2026 14:35:18) (NTS)

Confirmed rebuilt ubuntu-7.0.32 has the fix via Ubuntu Resolute's backported php8.5.4-0ubuntu1.5 (changelog) — not upstream PHP 8.5.12, but both CVEs are patched. Alpine images ship the upstream 8.5.12.

And, just my opinion, I would also highly appreciate a version bump (7.0.33 or 7.0.32-1) instead of same-tag rebuilds. Immutable tags are much easier to work with.

All latest tags are updated + updated published a few days ago 6.0.49, 7.0.32 and 7.4.16 versions.

Hello,

What am I doing wrong ?

$ docker pull zabbix/zabbix-web-nginx-pgsql:7.4-ubuntu-latest
7.4-ubuntu-latest: Pulling from zabbix/zabbix-web-nginx-pgsql
Digest: sha256:33572de706e7078610437fd4ae4f925fee7a81f6412850d617039cbe555cc218
Status: Downloaded newer image for zabbix/zabbix-web-nginx-pgsql:7.4-ubuntu-latest
docker.io/zabbix/zabbix-web-nginx-pgsql:7.4-ubuntu-latest

$ docker run --rm zabbix/zabbix-web-nginx-pgsql:7.4-ubuntu-latest php -v
PHP 8.5.4 (cli) (built: Oct 19 2026 14:35:18) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.4, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.4, Copyright (c), by Zend Technologies

@tlebars

@tlebars Nothing, see answer of @abregar-dhi. CVE is fixed with Ubuntu Resolute's backported php8.5.4-0ubuntu1.5, while not using the upstream version 8.5.12.
Its no problem to use, but if you wanna see a 8.5.12 there, maybe you can do with the alpine image (zabbix/zabbix-web-nginx-pgsql:7.4-alpine-latest).

you can use apt list --installed | grep php to show the exact version and compare that to ubuntus list in here: https://ubuntu.com/security/notices/USN-8948-1

Oh sorry, I skimmed through the messages too quickly. Thank you for taking the time to reply.

Navigation Menu

Repository navigation

High severity CVE in PHP CVE-2026-109618/109619, should be fixed in 8.5.12 #1982

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

High severity CVE in PHP CVE-2026-109618/109619, should be fixed in 8.5.12 #1982

Description

Activity

z37a commented on Oct 21, 2026

dotneft commented on Oct 22, 2026

Thibugs commented on Oct 22, 2026

dautzenb commented on Oct 22, 2026

seren commented on Oct 22, 2026

exu-g commented on Oct 22, 2026

fedorovvl commented on Oct 22, 2026

deepakkamath01 commented on Oct 22, 2026

abregar-dhi commented on Oct 22, 2026

dotneft commented on Oct 23, 2026

tlebars commented on Oct 23, 2026

PH89 commented on Oct 23, 2026

janitor-of-code commented on Oct 23, 2026

tlebars commented on Oct 23, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions