Critical PHP security release

Incident Report for amazee.io

Update

Lagoon base images v26.10.0 are now published and available. Customers are advised to deploy their environments to patch the PHP vulnerabilities.

We have increased resources to help reduce build queues, but expect wait times while all deployments are processed.

We will continue to monitor deployment queues until operations normalize.

Posted Oct 21, 2026 - 19:22 UTC

Update

New Lagoon images are currently building.

The required upstream Docker images have been released. We are currently building and testing version 26.10.0 of our Lagoon base images.

The new images will be published shortly. We will provide a final update as soon as they are available for deployment.

Posted Oct 21, 2026 - 17:22 UTC

Monitoring

The fixed PHP versions have been released, and more details have been announced, including mitigations https://www.php.net/archive/2026.php#2026-10-21-5.

We are waiting for the new versions to get released to all our upstream dependencies before we can release a new version of the Lagoon base images.

Posted Oct 21, 2026 - 14:44 UTC

Update

We have enabled the virtual patch for customers using our managed NGWAF.
You should still upgrade your Lagoon base images as soon as a patch is available.

Posted Oct 21, 2026 - 10:51 UTC

Investigating

amazee.io is aware of an upcoming critical PHP security release that will fix two CVEs: CVE-2026-109618 and CVE-2026-109619. The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

As soon as a patch is available, Lagoon base images will be updated and customers are encouraged to redeploy as soon as possible.

For more information, see the upstream PHP announcement: https://www.php.net/archive/2026.php#2026-10-20-1

We are monitoring the situation and investigating platform-level mitigations. We will update this status page with additional information as it becomes available.

Posted Oct 21, 2026 - 03:43 UTC