Critical PHP Security Release

Dan Brown posted on the 21st of October 2026

Note: This page will be updated with additional guidance throughout the day as extra details & patches become available.

BookStack runs on PHP.
The PHP project has announced an upcoming critical security release.

There are reports that the details of the bugs have been found/leaked before the disclosure time, allowing remote code execution on affected systems.

If you run a BookStack instance on the open web, or in any environment where it could be accessed by potential attackers or untrusted users, it may be best to take the instance offline (turn off the server, disable web traffic etc…) until patches are made available and applied in your hosting environment.

Remedies

As of 13:50 UTC, details have been published on the PHP website.

Fixes are included as part of the following versions of PHP:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Note: Some environments will ‘backport’ (re-apply) fixes to older versions, so fixed versions may confusingly show old version numbers.

We will monitor how these are rolled out and applied to common environments below.

Common BookStack Environments

• 🟠 Ubuntu (Installed with our install scripts)
  • 🟢 Fixed official PHP packages available for LTS 22.04, 24.04 and 26.04.
    • ⚠️ Backports are applied to Ubuntu, so version numbers may not reflect the ‘fixed’ versions. See below.
  • 🟠 PHP packages provided by the deb sury (ondrej/php) repo are slowly rolling out
    • These are often used for getting later/earlier PHP versions. You might be using these packages if you’ve upgraded the PHP version without upgrading your operating system.
• 🔴 Docker: LinuxServer Image - Awaiting Fix, they are aware, currently working on it 👷
• 🟢 Docker: solidnerd Image
  • Fixed PHP available in the most recent versions of the 26.9.2, 26.9, and latest tags.
• 🔴 Home Assistant: BookStack Community App - Awaiting Fix
• 🟠 Debian - Fixed versions available
  • ℹ️ These come from the Debian security repository. If you are not receiving the new versions ensure that you have the Debian security repository enabled.
    • 🟢 PHP 8.4.27 is available in official Debian Trixie package repositories.
    • 🟢 PHP 8.2.35 is available in official Debian Bookworm package repositories.
  • 🟠 PHP packages provided by the deb sury (ondrej/php) repo are slowly rolling out
    • These are often used for getting later/earlier PHP versions. You might be using these packages if you’ve upgraded the PHP version without upgrading your operating system.
• 🔴 RHEL/Rocky/Alma Linux - Awaiting Fix
  • ⚠️ rpms.remirepo.net will not receive updates today. It’s advised that you move to distro packages (when made available) or build from source. Otherwise, it’s best to keep these environments offline for now.
• 🟠 Arch AUR Package
  • 🟢 Dependent Arch PHP package updated, so updating packages should get the fixed PHP version.
  • ⚠️ The version of BookStack in the AUR is outdated and is lacking BookStack security release patches.

Applying Updates

Here’s some guidance for updating to use fixed PHP versions in common BookStack environments:

1
2

sudo apt update
sudo apt upgrade

1

sudo systemctl restart apache2.service 'php8*.service'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Find the BookStack container ID by running:
docker ps

# Check the PHP version inside the container
docker exec container_id php -v

# Example output:
# PHP 8.5.12 (cli) (built: Oct 21 2026 15:49:40) (NTS)
# Copyright (c) The PHP Group
# Built by https://github.com/docker-library/php
# Zend Engine v4.5.12, Copyright (c) Zend Technologies
#     with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

Validating PHP Version

In many environments, you can simply run php -v to check the version of PHP installed but this won’t ensure that’s the version being used for serving BookStack. Sometimes there can be multiple versions of PHP in use, or the web server could be using an outdated version.

Ideally, you’d check the version via the web-server.

1

apt list --installed 'php8.*-curl' 2>/dev/null

1
2

Listing... Done
php8.3-curl/noble-security,now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,automatic]

1

sudo systemctl restart apache2.service 'php8*.service'

1

echo '<?php $m=["8.2"=>"8.2.35","8.3"=>"8.3.36","8.4"=>"8.4.27","8.5"=>"8.5.12"];$v=PHP_VERSION;$p=explode(".",$v);$l=$p[0].".".$p[1];echo $v." ".(isset($m[$l])&&version_compare($v,$m[$l],">=")?"PASS":"FAIL").PHP_EOL;' | sudo tee /var/www/bookstack/public/check.php

1

sudo systemctl restart apache2.service 'php8*.service'

Workarounds

If you are not able to patch your systems, the PHP project has published some measures in their blog post to reduce exposure to specific attack surfaces, mostly by changing PHP configuration. They advise these don’t make an installation safe though, and that patching is the primary solution.

Issue & Patch Tracking

These issues are assigned the following IDs:

• CVE-2026-109618, GHSA-w8hw-w9fx-j79w
• CVE-2026-109619, GHSA-6wmf-4rv5-p3rp

The PHP project has posted details on the PHP website.

Further Help

Feel free to ask for help in the BookStack community forum. I’ll be monitoring for new posts more frequently over the next day to provide support.

If you’d like to be notified of future BookStack related security concerns, you may want to consider signing up to the BookStack security mailing list.

Supporting the PHP Ecosystem

The folks working on PHP are doing a great job. Handling scenarios like this can be extremely hard, and it requires a lot of work and mental effort from the maintainers of PHP and its supporting distribution.

Where able and willing, here are some good options for financially supporting the PHP ecosystem:

• The PHP Foundation - A foundation helping sustain core development work
• Ondřej Surý - Provides Debian/Ubuntu PHP packages used by many
• Remi Collet - Provides RHEL packages used by many

Header Image Credits: Photo by Giles Laurent (cc-by-sa-4) - Image Modified