Skip to content

Security release post: use composer update -W #2228

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mnapoli merged 1 commit into from
Oct 21, 2026
+6 −6
Merged

Security release post: use composer update -W #2228

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion website/content/news.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ You can also follow [@brefphp](https://x.com/brefphp) on X.

## [PHP security release of October 2026](/news/06-php-security-release-october-2026)

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix **two critical vulnerabilities**. The Bref 3 layers and Docker images are updated in all regions: **update your applications now** with `composer update bref/bref` and redeploy.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix **two critical vulnerabilities**. The Bref 3 layers and Docker images are updated in all regions: **update your applications now** with `composer update bref/bref -W` and redeploy.

[▶ Read more](/news/06-php-security-release-october-2026)

Expand Down
10 changes: 5 additions & 5 deletions website/content/news/06-php-security-release-october-2026.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,10 @@ PHP released a critical security update today. The Bref 3 layers and Docker imag
**Update your applications now**:

```bash
composer update bref/bref
composer update bref/bref -W
```

Then redeploy. That's it for most applications, the details are below.
Then redeploy. That's it for most applications, the details are below. (`-W` lets Composer update Bref's own dependencies too, without it the update can fail.)

## What happened

Expand Down Expand Up @@ -66,7 +66,7 @@ The Bref 2 layers are published too (version 2.3.45, PHP 8.2 to 8.4), one hour a
| 8.3 | `php-83:71` and `php-83-fpm:71` |
| 8.2 | `php-82:115` and `php-82-fpm:115` |

[`bref/bref` 2.4.22](https://github.com/brefphp/bref/releases/tag/2.4.22) uses these layers: run `composer update bref/bref` and redeploy, same as for Bref 3. The v2 Docker images (`bref/php-8x-fpm:2`, `bref/php-8x:2` and `bref/php-8x-console:2`) are updated as well, the `2` and `2.3.45` tags point to the new PHP versions.
[`bref/bref` 2.4.22](https://github.com/brefphp/bref/releases/tag/2.4.22) uses these layers: run `composer update bref/bref -W` and redeploy, same as for Bref 3. The v2 Docker images (`bref/php-8x-fpm:2`, `bref/php-8x:2` and `bref/php-8x-console:2`) are updated as well, the `2` and `2.3.45` tags point to the new PHP versions.

Bref 1 layers will not be rebuilt: Bref 1 is not maintained anymore. If you are still on Bref 1, now is a good time to upgrade.

Expand All @@ -77,7 +77,7 @@ Bref 1 layers will not be rebuilt: Bref 1 is not maintained anymore. If you are
Update Bref to 3.0.14 or later, and redeploy:

```bash
composer update bref/bref
composer update bref/bref -W
serverless deploy
```

Expand Down Expand Up @@ -116,7 +116,7 @@ The function runtime, Laravel Octane, console commands and queue workers run `ph
- the CLI SAPI doesn't parse request bodies itself: Bref parses multipart requests in PHP code
- a fatal error or running out of memory ends the process

Update them anyway. The fix is in the Zend engine itself, and every layer was rebuilt. `composer update bref/bref` updates all your functions at once, so there is nothing extra to do.
Update them anyway. The fix is in the Zend engine itself, and every layer was rebuilt. `composer update bref/bref -W` updates all your functions at once, so there is nothing extra to do.

## What about mitigations?

Expand Down
Loading