From e61500300c413e936d7314b6ab75681918642d9e Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:29:41 +0200 Subject: [PATCH 1/7] Blog post: PHP security release of October 2026 --- website/content/news.mdx | 6 + .../06-php-security-release-october-2026.mdx | 124 ++++++++++++++++++ website/content/news/_meta.js | 1 + 3 files changed, 131 insertions(+) create mode 100644 website/content/news/06-php-security-release-october-2026.mdx diff --git a/website/content/news.mdx b/website/content/news.mdx index 9dcae01ac..9bb381a98 100644 --- a/website/content/news.mdx +++ b/website/content/news.mdx @@ -13,6 +13,12 @@ Get Bref news by email: You can also follow [@brefphp](https://x.com/brefphp) on X. +## [PHP security release of October 2026](/news/06-php-security-release-october-2026) + +PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix **two critical vulnerabilities**. The Bref 3 layers and Docker images are updated in all regions: **update your applications now** with `composer update bref/bref` and redeploy. + +[▶ Read more](/news/06-php-security-release-october-2026) + ## [October 2026: simpler uploads, better logs, multiple queues, and Vapor migrations](/news/05-october-2026) What's new with Bref in September: **simpler large file uploads** with Laravel, **multiple SQS queues**, a guide for **migrating from Laravel Vapor**, **logs and deployments in the terminal** with `bref logs`, the **logs of a single request**, and clearer errors when a deployment fails. diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx new file mode 100644 index 000000000..87082761b --- /dev/null +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -0,0 +1,124 @@ +--- +title: PHP security release of October 2026 +seoTitle: "Bref: PHP security release of October 2026" +description: "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities. Bref layers and Docker images are updated: here is how to update your applications." +--- + +import ArticleHeader from '../../src/components/news/ArticleHeader'; + +# PHP security release of October 2026 + + + +PHP released a critical security update today. The Bref 3 layers and Docker images with the patched PHP versions are already published in all regions. + +**Update your applications now**: + +```bash +composer update bref/bref +``` + +Then redeploy. That's it for most applications, the details are below. + +## What happened + +Yesterday, the PHP team announced a critical security release for today at 14:00 UTC: two vulnerabilities, rated 9.2 on the CVSS scale. The release came out a bit earlier, at 13:35 UTC: [PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35](https://www.php.net/archive/2026.php#2026-10-21-5). + +The two vulnerabilities: + +- **CVE-2026-109618**: remote code execution through state corruption when PHP runs out of memory while starting a request or parsing its body. Multipart requests can trigger it, whatever your application code does. +- **CVE-2026-109619**: remote code execution through state left behind by a request and used by the next request on the same worker. Session upload progress is one confirmed path, validated on PHP-FPM. + +PHP lists PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed as affected. And their advisory is very clear: "there are no complete mitigations, updating is the only safe choice". + +PHP 8.1 and older are end of life and don't get a fix. If you still run one of those, upgrade to PHP 8.2 or later. + +## What's updated in Bref + +PHP was released at 13:35 UTC. The pull requests to update the Bref layers were opened at 13:37, CI was green at 13:59, and the new layers and Docker images were published in every region at 14:06. That's 31 minutes after php.net. + +That was fast because we prepared everything in advance: the scripts to bump PHP versions were ready and the build cache was warm. All that was left was to wait for PHP, open the PRs and publish. + +The new Bref 3 layers (x86 and ARM, all regions): + +| PHP | Layer version | +|-----|---------------| +| 8.5 | `php-85:21` | +| 8.4 | `php-84:24` | +| 8.3 | `php-83:24` | +| 8.2 | `php-82:26` | + +[`bref/bref` 3.0.14](https://packagist.org/packages/bref/bref) is on Packagist and uses these layers. + +The Docker images are updated too: `bref/php-82` to `bref/php-85`, `bref/arm-php-82` to `bref/arm-php-85`, as well as the `bref/php-8x-dev` and `bref/build-php-8x` images. The `3`, `3.0.10` and `latest` tags point to the new versions. + +### Bref 2 + +The Bref 2 layers (version 2.3.45, PHP 8.2 to 8.4) are coming within the hour, along with the v2 Docker images (`bref/php-8x-fpm:2`, `bref/php-8x:2` and `bref/php-8x-console:2`). I will update this post when they are published, and you can follow [this GitHub issue](https://github.com/brefphp/bref/issues/2222). + +Bref 1 layers will not be rebuilt: Bref 1 is not maintained anymore. If you are still on Bref 1, now is a good time to upgrade. + +## How to update + +### With layers (`serverless.yml`) + +Update Bref to 3.0.14 or later, and redeploy: + +```bash +composer update bref/bref +serverless deploy +``` + +If you use layer ARNs directly instead of the Bref runtimes (e.g. `runtime: php-84-fpm`), get the new ARNs on [runtimes.bref.sh](https://runtimes.bref.sh). + +### With Docker images + +Your Docker cache still has the old base images with the old PHP version. Pull them again when building, then push the image and redeploy: + +```bash +docker build --pull -t my-app . +``` + +(or run `docker pull bref/php-84:3` before building) + +### With Bref Cloud + +If you deploy Laravel applications with Bref Cloud, they will get the new layers on their next deploy once Bref Cloud is updated later today. + +### Check that it worked + +The function should use the new layer versions listed above: + +```bash +aws lambda get-function-configuration --function-name my-function --query Layers +``` + +You can also check the PHP version with `php -v`, or in the `X-Powered-By` HTTP header: it should be 8.5.12, 8.4.27, 8.3.36 or 8.2.35. + +## Which functions are affected? + +The PHP-FPM runtime is squarely in scope: that's the `php-84-fpm` runtime (or `BREF_RUNTIME=fpm`), used for web applications with Laravel, Symfony, etc. Update these first. + +The function runtime, Laravel Octane, console commands and queue workers run `php-cli` in a single long-lived process. They are not in the attack paths described by PHP: + +- the CLI SAPI doesn't parse request bodies itself: Bref parses multipart requests in PHP code +- a fatal error or running out of memory ends the process + +Update them anyway. The fix is in the Zend engine itself, and every layer was rebuilt. `composer update bref/bref` updates all your functions at once, so there is nothing extra to do. + +## What about mitigations? + +I don't recommend any mitigation instead of updating. Here is why: + +- `session.upload_progress.enabled=0` only covers part of one of the two vulnerabilities (PHP says so in the advisory). +- `file_uploads=Off` and `post_max_size` do nothing here. + +If you need a few hours before you can deploy and your application doesn't handle file uploads, blocking multipart requests in your WAF or CDN can help as a stopgap. But then update. + +## Thanks + +Thank you to the PHP security team for the fix and the release, and to the people who reported these vulnerabilities (Wiz, lcfr-hax and others, see [the advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). diff --git a/website/content/news/_meta.js b/website/content/news/_meta.js index ed1340beb..e704cc9f9 100644 --- a/website/content/news/_meta.js +++ b/website/content/news/_meta.js @@ -1,4 +1,5 @@ export default { + '06-php-security-release-october-2026': 'PHP security release of October 2026', '05-october-2026': 'October 2026: simpler uploads, better logs, multiple queues, and Vapor migrations', '04-august-2026': 'August 2026: osls v4 and zero-downtime assets', '03-bref-3.0': 'Bref 3.0 is released', From 4d9bcc2093483f32cde4414d643581f2a5d66f4f Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:32:41 +0200 Subject: [PATCH 2/7] Thank Depot and invite to sponsor in the PHP security post --- website/content/news/06-php-security-release-october-2026.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index 87082761b..8ededa1fa 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -43,6 +43,8 @@ PHP was released at 13:35 UTC. The pull requests to update the Bref layers were That was fast because we prepared everything in advance: the scripts to bump PHP versions were ready and the build cache was warm. All that was left was to wait for PHP, open the PRs and publish. +The layers are built on [Depot](https://depot.dev/?ref=bref.sh), a Bref sponsor: their remote builders and shared build cache are what made the builds this fast today. Without them we couldn't have reacted this quickly to the release. Thank you Depot, it really made a difference. + The new Bref 3 layers (x86 and ARM, all regions): | PHP | Layer version | @@ -122,3 +124,5 @@ If you need a few hours before you can deploy and your application doesn't handl ## Thanks Thank you to the PHP security team for the fix and the release, and to the people who reported these vulnerabilities (Wiz, lcfr-hax and others, see [the advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). + +Days like today are possible thanks to the companies and people who sponsor Bref. If Bref matters to your company, consider [sponsoring the project](/support). From ec31fbc00e59fa88d9d04f41a32368a57522ec15 Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:33:03 +0200 Subject: [PATCH 3/7] Move the Depot thanks to the Thanks section --- website/content/news/06-php-security-release-october-2026.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index 8ededa1fa..c6ebd69a3 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -43,8 +43,6 @@ PHP was released at 13:35 UTC. The pull requests to update the Bref layers were That was fast because we prepared everything in advance: the scripts to bump PHP versions were ready and the build cache was warm. All that was left was to wait for PHP, open the PRs and publish. -The layers are built on [Depot](https://depot.dev/?ref=bref.sh), a Bref sponsor: their remote builders and shared build cache are what made the builds this fast today. Without them we couldn't have reacted this quickly to the release. Thank you Depot, it really made a difference. - The new Bref 3 layers (x86 and ARM, all regions): | PHP | Layer version | @@ -125,4 +123,6 @@ If you need a few hours before you can deploy and your application doesn't handl Thank you to the PHP security team for the fix and the release, and to the people who reported these vulnerabilities (Wiz, lcfr-hax and others, see [the advisory](https://www.php.net/archive/2026.php#2026-10-21-5)). +The Bref layers are built on [Depot](https://depot.dev/?ref=bref.sh), a Bref sponsor: their remote builders and shared build cache are what made the builds this fast today. Without them we couldn't have reacted this quickly to the release. Thank you Depot, it really made a difference. + Days like today are possible thanks to the companies and people who sponsor Bref. If Bref matters to your company, consider [sponsoring the project](/support). From f080c606af1846ea94714c51eb45badfa6480879 Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:33:44 +0200 Subject: [PATCH 4/7] Thank all sponsors in the PHP security post --- .../06-php-security-release-october-2026.mdx | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index c6ebd69a3..25e915ac5 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -125,4 +125,25 @@ Thank you to the PHP security team for the fix and the release, and to the peopl The Bref layers are built on [Depot](https://depot.dev/?ref=bref.sh), a Bref sponsor: their remote builders and shared build cache are what made the builds this fast today. Without them we couldn't have reacted this quickly to the release. Thank you Depot, it really made a difference. +Thank you to the companies that sponsor Bref: + +**Premium sponsors:** + +- [Craft CMS](https://craftcms.com/?ref=bref.sh) +- [Voxie](https://voxie.com/?ref=bref) +- [MyBuilder](https://www.mybuilder.com/?ref=bref.sh) +- [Null](https://null.tc/?ref=bref) +- [AWS](https://aws.amazon.com/?ref=bref) (one-time sponsor) + +**Gold sponsors:** + +- [Depot](https://depot.dev/?ref=bref.sh) +- [SecuMailer](https://secumailer.com/?ref=bref.sh) +- [Ecomail](https://ecomail.cz/?ref=bref.sh) +- [Spreaker](https://www.spreaker.com/?ref=bref) +- [Runs On](https://runs-on.com/?ref=bref) +- [Playable](https://playable.com/?ref=bref) + +And [many other personal sponsors](https://github.com/sponsors/mnapoli#sponsors)! + Days like today are possible thanks to the companies and people who sponsor Bref. If Bref matters to your company, consider [sponsoring the project](/support). From 95e0ac9be486db8ec58a5dd64c6a4a3bf7b7cecf Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:34:14 +0200 Subject: [PATCH 5/7] Thank GitHub sponsors without listing names --- website/content/news/06-php-security-release-october-2026.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index 25e915ac5..1c479a77d 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -144,6 +144,6 @@ Thank you to the companies that sponsor Bref: - [Runs On](https://runs-on.com/?ref=bref) - [Playable](https://playable.com/?ref=bref) -And [many other personal sponsors](https://github.com/sponsors/mnapoli#sponsors)! +And thank you to everyone [sponsoring on GitHub](https://github.com/sponsors/mnapoli). Days like today are possible thanks to the companies and people who sponsor Bref. If Bref matters to your company, consider [sponsoring the project](/support). From c35379b8d9f6794637494e3dbd4e09d8b51e8f30 Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:34:38 +0200 Subject: [PATCH 6/7] Trim the sponsor list --- website/content/news/06-php-security-release-october-2026.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index 1c479a77d..4d525bfbf 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -132,8 +132,6 @@ Thank you to the companies that sponsor Bref: - [Craft CMS](https://craftcms.com/?ref=bref.sh) - [Voxie](https://voxie.com/?ref=bref) - [MyBuilder](https://www.mybuilder.com/?ref=bref.sh) -- [Null](https://null.tc/?ref=bref) -- [AWS](https://aws.amazon.com/?ref=bref) (one-time sponsor) **Gold sponsors:** From 0acd33129c33fdb55f6924afa7f399ea69382a81 Mon Sep 17 00:00:00 2001 From: Matthieu Napoli Date: Wed, 21 Oct 2026 16:36:43 +0200 Subject: [PATCH 7/7] Bref 2 layers are published --- .../news/06-php-security-release-october-2026.mdx | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/website/content/news/06-php-security-release-october-2026.mdx b/website/content/news/06-php-security-release-october-2026.mdx index 4d525bfbf..f9957a9bb 100644 --- a/website/content/news/06-php-security-release-october-2026.mdx +++ b/website/content/news/06-php-security-release-october-2026.mdx @@ -58,7 +58,15 @@ The Docker images are updated too: `bref/php-82` to `bref/php-85`, `bref/arm-php ### Bref 2 -The Bref 2 layers (version 2.3.45, PHP 8.2 to 8.4) are coming within the hour, along with the v2 Docker images (`bref/php-8x-fpm:2`, `bref/php-8x:2` and `bref/php-8x-console:2`). I will update this post when they are published, and you can follow [this GitHub issue](https://github.com/brefphp/bref/issues/2222). +The Bref 2 layers are published too (version 2.3.45, PHP 8.2 to 8.4), one hour after php.net: + +| PHP | Layer version | +|-----|---------------| +| 8.4 | `php-84:43` and `php-84-fpm:43` | +| 8.3 | `php-83:71` and `php-83-fpm:71` | +| 8.2 | `php-82:115` and `php-82-fpm:115` | + +[`bref/bref` 2.4.22](https://github.com/brefphp/bref/releases/tag/2.4.22) uses these layers: run `composer update bref/bref` and redeploy, same as for Bref 3. The v2 Docker images (`bref/php-8x-fpm:2`, `bref/php-8x:2` and `bref/php-8x-console:2`) are updated as well, the `2` and `2.3.45` tags point to the new PHP versions. Bref 1 layers will not be rebuilt: Bref 1 is not maintained anymore. If you are still on Bref 1, now is a good time to upgrade.