PHP CVEs. Attention required! What about Nextcloud pi?

please look at PHP CVEs. Attention required! nextcloud/server#65754

what about Nextcloudpi?

At least in my deployment (nextcloudpi as LXC container) it just uses debian packages. Debian released patches already, so regular package updates via apt should fix this.

I made sure to take the site offline while I was updating.

Here are explicit details on the fixes: https://www.php.net/archive/2026.php#2026-10-21-5

PHP 8.5.12
8.4.27
8.3.36
8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

If you haven't dist upgraded yet, Bookworm is still only shipping 8.3.35 for PHP 8.3. EDIT: Should mention that's the sury.org repository; main repo only ships PHP 8.2.

I'm on trixie (PC, AMD64) with php 8.3.36 from 21.10. via sury.org. Should be save.

I'm on Debian 13 (Trixie) ARM64 with the Sury repository, but PHP 8.3.35 is still the latest available version (apt update shows no updates).

Is PHP 8.3.36 for ARM64 still pending?

⚠️ I'm not sure if this is a good thing to do, but I did it:

I had to do:

sudo apt install debsuryorg-archive-keyring

before the update went through.

6. I'm on Debian 13 (Trixie) ARM64 with the Sury repository, but PHP 8.3.35 is still the latest available version (apt update shows no updates).
Is PHP 8.3.36 for ARM64 still pending?

Yes, it seems so, only amd64 is available...

6. I'm on Debian 13 (Trixie) ARM64 with the Sury repository, but PHP 8.3.35 is still the latest available version (apt update shows no updates).
Is PHP 8.3.36 for ARM64 still pending?

That seems to be the same situation I'm in
php is on 8.3.36, but php-cli and php-fpm (and all others) are still on 8.3.35:

apt list --installed php*
php-common/trixie,trixie,now 2:101+0~20261021.78+debian13~1.gbp53f25f all [installed,automatic]
php8.3-apcu/trixie,now 5.1.28-2+0~20260623.59+debian13~1.gbp4679cd arm64 [installed]
php8.3-bcmath/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-bz2/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-cli/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-common/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-curl/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-fpm/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-gd/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-gmp/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-igbinary/trixie,now 3.2.16-6+0~20260709.60+debian13~1.gbp1eff65 arm64 [installed,automatic]
php8.3-intl/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-ldap/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-mbstring/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-mysql/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-opcache/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-readline/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed,automatic]
php8.3-redis/trixie,now 6.3.0-2+0~20260711.69+debian13~1.gbpd148c3 arm64 [installed]
php8.3-xml/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3-zip/trixie,now 8.3.35-1+0~20260925.87+debian13~1.gbp19383d arm64 [installed]
php8.3/trixie,trixie,now 8.3.36-1+0~20261021.88+debian13~1.gbp250f7c all [installed]

php -v returns 8.3.35.
Nextcloud Admin -> System also shows 8.3.35

So i guess we have to wait and keep our services internal

form ARM see:
https://packages.sury.org/bind/dists/trixie/
also see german heise forum:
https://www.heise.de/forum/heise-online/Kommentare/php2shell-Updates-trudeln-ein-viele-Webseiten-offline-Angriffe-laufen/RasPi-ARM64-bleibt-auf-8-3-35/posting-46713157/show/

Thanks for looking into this.

I'm running NextcloudPi v1.58.0 on Debian 12 (Bookworm), ARM64, with Nextcloud 33.0.10.

I have the "Automatic installation of security updates" option enabled in NextcloudPi.

Will this automatically install the patched PHP packages once they become available, or is manual intervention required?

In particular, does this mechanism also cover PHP packages from the Sury repository, or only Debian's official security repositories?

Thanks!

In particular, does this mechanism also cover PHP packages from the Sury repository, or only Debian's official security repositories?

I had the impression that Sury packages were not updated on my NextcloudPi at all, I might be mistaken though. If this is indeed the case, this should maybe be a separate issue.

Yes, indeed: /etc/apt/apt.conf.d/20ncp-upgrades allows o=deb.sury.org,n=bookworm-security, but I only got the PHP updates from the non-security branch. So unattended-upgrades did not do anything.

Update: As commented below, seems like a bit bigger task to upgrade to php8.3.36 or any other patched versions at https://cert.europa.eu/publications/security-advisories/2026-018

Thanks

@ivartz

@ivartz try php8.3-fpm. php8.3 itself is an any package, no binaries. It is nothing but text files inside.

14. For NCP users on Debian Bookworm, safe 8.3.36 is available:
apt update
apt-cache policy php8.3
php8.3: Installed: 8.3.11-1+0~20240902.42+debian12~1.gbp1a56f8 Candidate: 8.3.36-1+0~20261021.88+debian12~1.gbp250f7c Version table: 8.3.36-1+0~20261021.88+debian12~1.gbp250f7c 500 500 https://packages.sury.org/php bookworm/main arm64 Packages *** 8.3.11-1+0~20240902.42+debian12~1.gbp1a56f8 100 100 /var/lib/dpkg/status
     apt upgrade php8.3

Dude, php8.3 is just a metapackage. Check php8.3-cli and php8.3-fpm — if they're still on 8.3.35, keep your instance offline!

php -v
apt-cache policy php8.3-cli php8.3-fpm libapache2-mod-php8.3

My package is still on 8.3.17, according to php -v, but I am on the latest nextcloudpi 1.58.0 release, on bookworm armbian, from the recommended installer. I have unattended-upgrades enabled. Not sure how to get the fixes without messing up the nextcloudpi installation.

Can I safely apt upgrade php8.3 and then check that it has actually upgraded php8.3-cli php8.3-fpm ? Or does manually using apt to upgrade mess up the ncp system? In the past I have been told never to apt upgrade on nextcloudpi.

Workaround for Debian 12 NCP. Change all PHP packages to 8.2.35

Nextcloud Hub 26 Winter (33.0.10)

OS: Debian 12 Bookworm

Change all php software to 8.2.35 (downgrade)

while read package; do echo $package; rest=${package#*-}; cmd="apt install php8.2-$rest -y"; echo $cmd; eval $cmd; done <<< $(dpkg -l | grep -i php | tr -s ' ' | cut -d ' ' -f 2)

apt purge php8.5*
apt purge php8.3*

Install apache2 module for php8.2

apt install libapache2-mod-php8.2

Some minor fixes from warnings (may differ depending on your configuration):

Missing imagemagick:

apt install libmagickcore-6.q16-6-extra

Default memory limit too low, set higher:

sudo sed -i 's/memory_limit = 128M/memory_limit = 512M/' /etc/php/8.2/apache2/php.ini

Another similar warning with solution;

vim /etc/php/8.2/apache2/php.ini

opcache.interned_strings_buffer=16

(sudo systemctl restart apache2)

reboot

Note that this will give you the warning:

PHP version
You are currently running PHP 8.2.35. PHP 8.2 is deprecated since Nextcloud 33. Nextcloud 34 may require at least PHP 8.3. Please upgrade to one of the officially supported PHP versions provided by the PHP Group as soon as possible.

However, this lets you run a secure PHP version. A more proper solution would be upgrading to the latest supported Debian version for NCP and choose a higher patched php version.

Keep your instances offline until the updated builds are available, that's all you can do. They take a while.

@ivartz

@ivartz This may fix the immediate security issue, but purging PHP 8.3 and downgrading to 8.2 risks breaking future NCP updates, since NCP expects PHP 8.3. You may also lose existing PHP configurations.

I wouldn't recommend this as a general workaround. It solves one security problem but potentially creates a long-term maintenance problem.

The following repo already has the updated ARM builds (mirrored by Sury), while Sury's builds are still running:

echo "deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/freexian/ trixie main" \
  | sudo tee /etc/apt/sources.list.d/sury-freexian.list
sudo apt update
sudo apt install --only-upgrade 'php8.3*'

See Sury's comments here: https://codeberg.org/oerdnj/deb.sury.org/issues/145

The ARM images are now available on Sury's main repo.

Navigation Menu

Repository navigation

PHP CVEs. Attention required! What about Nextcloud pi? #2148

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

PHP CVEs. Attention required! What about Nextcloud pi? #2148

Description

Activity

yourfate commented on Oct 21, 2026

sunjam commented on Oct 21, 2026

charabaruk commented on Oct 22, 2026

markusonwheels83 commented on Oct 22, 2026

citizenserious commented on Oct 22, 2026

janvlug commented on Oct 22, 2026

adrigrillo commented on Oct 22, 2026

mayermart commented on Oct 22, 2026

markusonwheels83 commented on Oct 22, 2026

githubtefo commented on Oct 22, 2026

janvlug commented on Oct 22, 2026

joneuhauser commented on Oct 22, 2026

ivartz commented on Oct 22, 2026

charabaruk commented on Oct 22, 2026

citizenserious commented on Oct 22, 2026

ph818 commented on Oct 22, 2026

ivartz commented on Oct 22, 2026

charabaruk commented on Oct 23, 2026

citizenserious commented on Oct 23, 2026

m-breitbach commented on Oct 23, 2026

m-breitbach commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions