PHP Vulnerability Responses by Company

Chainguard

Global cloud / infrastructure
Aliases / services
チェインガード / Chainguard Images / Chainguard
Official website
https://www.chainguard.dev/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Chainguard PHP images

Response status
Patched delivery completed
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides maintained container images.

October 22 resolution confirms delivery to all customer registries; listed backports qualify.

Scope: Delivery does not update workloads. Migrate PHP 8.1.

What users should do

Verify SBOMs, update digests/mirrors and redeploy.

Official service URL

Source URLs

  1. https://status.chainguard.dev/incident/1098100?mp=truehttps://status.chainguard.dev/incident/1098100?mp=trueResponse evidence
  2. https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619Service and operation documentation

Chainguard Custom Assembly (PHP)

Response status
Check package pins
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

PHP package pins can block fixes.

Scope: Update pinned digests too.

What users should do

Update/remove pins, verify rebuilt SBOMs and redeploy.

Source URLs

  1. https://status.chainguard.dev/incident/1098100?mp=truehttps://status.chainguard.dev/incident/1098100?mp=trueResponse evidence

Chainguard operated platform

Response status
Not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Console, registries and APIs do not run PHP.

Scope: This excludes image workloads.

What users should do

Update PHP images separately.

Source URLs

  1. https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619https://support.chainguard.dev/hc/en-us/articles/57552197172379-ACTION-REQUIRED-Update-Chainguard-images-with-PHP-for-CVE-2026-109618-and-CVE-2026-109619Response evidence
Related official sources
  1. Chainguard: PHP2Shell statusOfficial notice

Comments