Repository navigation
[BUG] Latest docker container has out of date php software in it : Linuxserver.io version:- 35.0.2-ls460 Build-date:- 2026-10-27T16:56:41+00:00 #550
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
PHP Bug with CVE of 9/10
I have nextcloud instance ("Linuxserver.io version:- 35.0.2-ls460 Build-date:- 2026-10-27T16:56:41+00:00")
ref docker pull lscr.io/linuxserver/nextcloud:latest
log into the Nextcloud server via docker cli
docker exec -it bash
when logged in type php -v to get the version
php -v
PHP 7.4.26 (cli) (built: Nov 18 2021 21:39:13) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
with Zend OPcache v7.4.26, Copyright (c), by Zend Technologies
This is very bad !!!
ref https://en.wikipedia.org/wiki/PHP2Shell
PHP2Shell is a pair of high-impact computer vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
concerning memory safety flaws in PHP versions 5.4–8.5 that allow remote code execution (RCE)
by a potential malicious user to gain remote control of the website host.
You really really need to fix this issue urgently by making a new image
--
FIX LIST
--
-
read https://www.php.net/
-
You need to biuld php from source with this version or newer of PHP https://downloads.php.net/~windows/releases/archives/php-8.5.12-1-src.zip
-
update the image
-
test the updated image
-
deploy the updated image to docker hub etc
Expected Behavior
Latest PHP version with the CVE shown errors fixed.
Steps To Reproduce
See the CVE notes
Environment
This issue is related to the docker image itself.CPU architecture
x86-64
Docker creation
docker image 35.0.2 put into service 29OCT2026Container logs
not relevant.
Activity
github-actions commentedon Oct 29, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
thespad commentedon Oct 29, 2026
I have no idea how you've managed to get that output, our Nextcloud image hasn't used php 7.4 in literally years.
aptalca commentedon Oct 29, 2026
It's not helpful when you provide incomplete reproduction steps.
You're pulling the latest nextcloud image. OK.
But you're not re/creating a container.
Your docker exec command is missing the container name. Who knows which container you're exec'ing into.
We have no idea what that
php -voutput is coming from. Certainly not from a container created from one of our recently pushed images.Yes, very bad for you, if you have a container running php 7.4.
We don't need to fix this issue, you do. You need to figure out which container on your system is running php 7.4, and take the necessary steps to update it, or destroy it. Definitely do not publicly expose it.
https://github.com/linuxserver/docker-nextcloud/blob/master/package_versions.txt#L373
SIBA-DK commentedon Oct 29, 2026
Hi
Thank you for your comments
I have investigate and your correct there is something funny going on with my docker system.
This what I get when do the same test as you
oot@vps:~# docker pull lscr.io/linuxserver/nextcloud:latest
latest: Pulling from linuxserver/nextcloud
Digest: sha256:b980e092ea0ce7b509b8c1f03b8b5ae244348faccd4ae9e519d61e32706aa20a
Status: Image is up to date for lscr.io/linuxserver/nextcloud:latest
lscr.io/linuxserver/nextcloud:latest
root@vps:~# docker run -it --rm --entrypoint /bin/bash --tmpfs /config lscr.io/linuxserver/nextcloud:latest
root@xxxxxxxxxx:/# php -v
PHP 8.5.12 (cli) (built: Oct 21 2026 16:29:26) (NTS)
Copyright (c) The PHP Group
Built by Alpine Linux aports
Zend Engine v4.5.12, Copyright (c) Zend Technologies
with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies
root:xxxxxxxxxxx/#
I have had to rebuild my docker instances.