Werk #19262: Docker image: Rebuild with patched PHP (PHP2Shell)
| Component | Site management | ||||||
| Title | Docker image: Rebuild with patched PHP (PHP2Shell) | ||||||
| Date | Oct 21, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Security Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
This release contains no code changes. We rebuilt the Checkmk Docker image so it includes the latest PHP packages from its Ubuntu base image. These fix the two critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"), which PHP fixed in the security release of 21 October 2026 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
Who is Affected
Only users running Checkmk as a Docker container are affected.
For all other installations, Checkmk uses the PHP packages of your Linux distribution (needed for NagVis, for example). These get the fix through your distribution's regular security updates, so no Checkmk update is required. Just make sure you install the PHP updates of your distribution.
If you run Checkmk in Docker, update to this release and recreate your container from the new image.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0
Vulnerability Management
The PHP project rates both vulnerabilities as critical with a CVSS v4.0 score of 9.2. We have not assessed whether they can be exploited in the context of Checkmk. Since PHP is part of the Docker image, we ship the fixed version as a precaution. For details, see the PHP announcement.
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Score: 9.2
- Severity: Critical