Critical PHP Security Release

Dan Brown Dan Brown posted on the 21st of October 2026

Note: This page has been evolving since its original publication. Post last updated 23rd October at 23:03 UTC

BookStack runs on PHP.
The PHP project has announced a critical security release.

There are reports that the details of the bugs have been found/leaked before the disclosure time, allowing remote code execution on affected systems.

If you run a BookStack instance on the open web, or in any environment where it could be accessed by potential attackers or untrusted users, it may be best to take the instance offline (turn off the server, disable web traffic etc…) until patches are made available and applied in your hosting environment.

23rd October Update - Additional Informational Advisory

Today the PHP project has released a new informational advisory related to session upload progress.

Based on the information provided, BookStack does not appear to set the conditions for this issue to be exploited.

If you wanted to be sure that this does not pose a risk in your environment, you could follow the PHP guidance and set session.upload_progress.enabled=0 in your PHP ini configuration until able to patch. Note that this would need to be set in the PHP ini configuration for the webserver process. This is often different to the ini configuration for command line PHP. For Ubuntu script installed BookStack systems, this is typically the configuration found at a path like /etc/php/8.3/fpm/php.ini (Replacing 8.3 with the PHP version in use on your system).

After changing any ini options, be sure to restart any PHP related processes to pick up changes:

1

sudo systemctl restart apache2.service 'php8*.service'

Remedies

As of 13:50 UTC, details have been published on the PHP website.

Fixes are included as part of the following versions of PHP:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

Note: Some environments will ‘backport’ (re-apply) fixes to older versions, so fixed versions may confusingly show old version numbers.

We will monitor how these are rolled out and applied to common environments below.

Common BookStack Environments

Ubuntu Systems (As per our official install scripts)

  • 🟢 Fixed official PHP packages available for LTS 22.04, 24.04 and 26.04.
    • ⚠️ Backports are applied to Ubuntu, so version numbers may not reflect the ‘fixed’ versions. See guidance below.
  • 🟢 PHP packages provided by the deb sury (ondrej/php) repo should be generally available now across PHP and OS versions.
    • These are often used for getting later/earlier PHP versions. You might be using these packages if you’ve upgraded the PHP version without upgrading your operating system.
    • Access to these repos has been reportedly somewhat unreliable.

Debian Systems

  • 🟢 Official packages: Fixes available.
    • PHP 8.4.27 is available in Debian Trixie repositories. PHP 8.2.35 is available in Debian Bookworm repositories.
    • ℹ️ These come from the Debian security repository. If you are not receiving the new versions, ensure that you have the Debian security repository enabled.
  • 🟢 PHP packages provided by the deb sury (ondrej/php) repo should be generally available now across PHP and OS versions.
    • These are often used for getting later/earlier PHP versions. You might be using these packages if you’ve upgraded the PHP version without upgrading your operating system.
    • Access to these repos has been reportedly somewhat unreliable.

Docker Images

  • 🟢 Docker: LinuxServer Image
  • 🟢 Docker: solidnerd Image

RHEL-based systems (Rocky/AlmaLinux/CentOS)

Other Environments

  • 🟢 Home Assistant: BookStack Community App
  • 🟢 Arch: AUR Package uses the arch PHP package which has been updated, so updating packages should get the fixed PHP version. The BookStack version installed is now also current.

Applying Updates

Here’s some guidance for updating to use fixed PHP versions in common BookStack environments:

For Ubuntu installs (following our scripts) and Debian

To update to patched versions of PHP you should simply update the system packages like normal:

1
2

sudo apt update
sudo apt upgrade

Those commands may restart the webserver/php processes themselves, but you can be sure by restarting them yourself:

1

sudo systemctl restart apache2.service 'php8*.service'
Docker: solidnerd Image

To update to a fixed version of the solidnerd docker image, re-pull and use the latest container images for the 26.9.2, 26.9, or latest tags. (Note: Old unfixed versions also used these tags. You can’t rely on the image tag alone).

Then re-create your BookStack container. If using docker compose, this is usually done via taking the stack down, then bringing it up again.

To validate your running instance is using a patched version of PHP, you can run php -v via the container, to ensure the response shows 8.5.12:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Find the BookStack container ID by running:
docker ps

# Check the PHP version inside the container
docker exec container_id php -v

# Example output:
# PHP 8.5.12 (cli) (built: Oct 21 2026 15:49:40) (NTS)
# Copyright (c) The PHP Group
# Built by https://github.com/docker-library/php
# Zend Engine v4.5.12, Copyright (c) Zend Technologies
#     with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies
Docker: LinuxServer Image

To update to a fixed version of the linuxserver docker image, re-pull and use the latest container images for the 26.09.2, version-v26.09.2 or the latest tags. (Note: Old unfixed versions also used these tags. You can’t rely on the image tag alone).

Then re-create your BookStack container. If using docker compose, this is usually done via taking the stack down, then bringing it up again.

To validate your running instance is using a patched version of PHP, you can run php -v via the container, to ensure the response shows 8.5.12:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Find the BookStack container ID by running:
docker ps

# Check the PHP version inside the container
docker exec container_id php -v

# Example output:
# PHP 8.5.12 (cli) (built: Oct 21 2026 16:29:26) (NTS)
# Copyright (c) The PHP Group
# Built by Alpine Linux aports
# Zend Engine v4.5.12, Copyright (c) Zend Technologies
#     with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies

Validating PHP Version

In many environments, you can simply run php -v to check the version of PHP installed but this won’t ensure that’s the version being used for serving BookStack. Sometimes there can be multiple versions of PHP in use, or the web server could be using an outdated version.

Ideally, you’d check the version via the web-server.

For a Ubuntu install (following our scripts)

Ubuntu has patched this via backports, which makes it not possible to check for fixes based on version number as per the option below.

Instead, we’ll check for a specific PHP package to check the version by running:

1

apt list --installed 'php8.*-curl' 2>/dev/null

This should output something like:

1
2

Listing... Done
php8.3-curl/noble-security,now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,automatic]

In this example, 8.3.6 is the PHP version and 8.3.6-0ubuntu0.24.04.13 is the full version string. Here’s how to confirm a fixed version of PHP:

  • PHP version starts with 8.5?
    • Full version exactly matches 8.5.4-0ubuntu1.5? Fixed
    • Version equal to or greater than 8.5.12? Fixed
    • Otherwise, not fixed.
  • PHP version starts with 8.4?
    • Version equal to or greater than 8.4.27? Fixed
    • Otherwise, not fixed.
  • PHP version starts with 8.3?
    • Full version exactly matches 8.3.6-0ubuntu0.24.04.13? Fixed
    • Version equal to or greater than 8.3.36? Fixed
    • Otherwise, not fixed.
  • PHP version starts with 8.1?
    • Full version exactly matches 8.1.2-1ubuntu2.28? Fixed
    • Otherwise, not fixed.

When comparing versions, in each of the above ’equal to or greater than’ checks, you are looking specifically at the third part of the number (e.g. 27 in the version 8.4.27).

If you see multiple versions, you may want to uninstall PHP versions not in use to avoid confusion as to what’s being used. You may also want to restart your server, or at least the webserver, to ensure any updated version is in use:

1

sudo systemctl restart apache2.service 'php8*.service'
For a standard on-system (non-docker) install - without backports (Debian, Arch)

You could check the PHP version by running the below command to place a version check script in the BookStack served files:

NOTE: This command assumes a /var/www/bookstack installation directory, which is the default when using our scripts.

1

echo '<?php $m=["8.2"=>"8.2.35","8.3"=>"8.3.36","8.4"=>"8.4.27","8.5"=>"8.5.12"];$v=PHP_VERSION;$p=explode(".",$v);$l=$p[0].".".$p[1];echo $v." ".(isset($m[$l])&&version_compare($v,$m[$l],">=")?"PASS":"FAIL").PHP_EOL;' | sudo tee /var/www/bookstack/public/check.php

With this set, in the browser visit <your_bookstack_instance_url>/check.php. You’ll see your PHP version number in use followed by ‘PASS’ if using a patched PHP version, or ‘FAIL’ if using a vulnerable version.

After checking, remove the created script: sudo rm /var/www/bookstack/public/check.php.

If the version shown differs from what’s seen when running php -v, ensure you’ve since restarted your webserver, and any PHP-related services:

1

sudo systemctl restart apache2.service 'php8*.service'

Workarounds

If you are not able to patch your systems, the PHP project has published some measures in their blog post to reduce exposure to specific attack surfaces, mostly by changing PHP configuration. They advise these don’t make an installation safe though, and that patching is the primary solution.

Issue & Patch Tracking

These issues are assigned the following IDs:

The PHP project has posted details on the PHP website.

Further Help

Feel free to ask for help in the BookStack community forum. I’ll be monitoring for new posts more frequently over the next day to provide support.

If you’d like to be notified of future BookStack-related security concerns, you may want to consider signing up to the BookStack security mailing list.

Supporting the PHP Ecosystem

The folks working on PHP are doing a great job. Handling scenarios like this can be extremely hard, and it requires a lot of work and mental effort from the maintainers of PHP and its supporting distribution.

Where able and willing, here are some good options for financially supporting the PHP ecosystem:

Header Image Credits: Photo by Giles Laurent (cc-by-sa-4) - Image Modified

Want to let me know what you think of BookStack or this post?
You can find me on Mastodon @danb@fosstodon.org or in the BookStack Community.

Subscribe to Updates

There are two lists you can sign-up to for updates, A general news & updates list, sent on a weekly basis, and a security alerts list that's sent when new security updates are available.

News and Updates | Security Alerts