Critical PHP security release

Summary

Critical PHP security release

Lagoon base images v26.10.0 are now published and available. Customers are advised to deploy their environments to patch the PHP vulnerabilities. We have increased resources to help reduce build queues, but expect wait times while all deployments are processed. We will continue to monitor deployment queues until operations normalize.

• Started

  Oct 21, 2026 · 3:43 AM

• Status

  Monitoring

• Duration

  Ongoing

• Severity

  None

• ◐

  Investigating

  Oct 21 · 3:43 AM amazee.io

  amazee.io is aware of an upcoming critical PHP security release that will fix two CVEs: CVE-2026-109618 and CVE-2026-109619. The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. As soon as a patch is available, Lagoon base images will be updated and customers are encouraged to redeploy as soon as possible. For more information, see the upstream PHP announcement: https://www.php.net/archive/2026.php#2026-10-20-1 We are monitoring the situation and investigating platform-level mitigations. We will update this status page with additional information as it becomes available.

• ◐

  Investigating

  Oct 21 · 10:51 AM amazee.io

  We have enabled the virtual patch for customers using our managed NGWAF. You should still upgrade your Lagoon base images as soon as a patch is available.

• ◉

  Monitoring

  Oct 21 · 2:44 PM amazee.io

  The fixed PHP versions have been released, and more details have been announced, including mitigations https://www.php.net/archive/2026.php#2026-10-21-5. We are waiting for the new versions to get released to all our upstream dependencies before we can release a new version of the Lagoon base images.

• ◉

  Monitoring

  Oct 21 · 5:22 PM amazee.io

  New Lagoon images are currently building. The required upstream Docker images have been released. We are currently building and testing version 26.10.0 of our Lagoon base images. The new images will be published shortly. We will provide a final update as soon as they are available for deployment.

• ◉

  Monitoring

  Oct 21 · 7:22 PM amazee.io

  Lagoon base images v26.10.0 are now published and available. Customers are advised to deploy their environments to patch the PHP vulnerabilities. We have increased resources to help reduce build queues, but expect wait times while all deployments are processed. We will continue to monitor deployment queues until operations normalize.