Following the disclosure of two critical PHP security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), we've updated the Team Password Manager Docker image and made it available on our website and Docker Hub.
This update includes PHP 8.4.27, which addresses both vulnerabilities. The new Docker image version is 15.200.312_2.
If you're running Team Password Manager using Docker, we strongly recommend updating to the latest image as soon as possible.
Update on the vulnerabilities
The PHP team has released security updates addressing both vulnerabilities. You can find the official announcement here:
Security advisory: Critical remote code execution vulnerabilities, update now
The following PHP versions include the fixes:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Ubuntu
Ubuntu has also released security updates addressing these vulnerabilities. However, the patched PHP package versions may differ from the official PHP versions listed above, as Ubuntu may backport security fixes to earlier versions.
For details on affected packages and available fixes, refer to the Ubuntu security notices:
We mention Ubuntu specifically because it is our reference operating system. Other Linux distributions may have already released updates or may still be preparing them. We recommend checking your distribution's security advisories.
Ondřej Surý PHP repositories
The Ondřej Surý PHP PPAs have also been updated with patched PHP packages. If you use these repositories, you can install the latest security updates through your regular package manager.
Regardless of your installation method, we strongly recommend ensuring that your PHP installation includes the fixes for both vulnerabilities.
