Faved Files

v2.10.1 – Security patch: PHP 8.5.12 (PHP2Shell)

This is a security-only release. It updates the PHP runtime in the Docker image to PHP 8.5.12, which fixes two critical remote code execution vulnerabilities in PHP core disclosed on October 21, 2026 and nicknamed "PHP2Shell". There are no application changes. All Docker-based installations should update immediately.

Security

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) – Updated the Docker base image from PHP 8.5 to PHP 8.5.12-apache. Both vulnerabilities are rated Critical (CVSS v4.0 9.2) by the PHP security team and can allow unauthenticated remote code execution on any PHP installation serving web requests, including Apache with mod_php as used by Faved. See the PHP security [advisory](https://www.php.net/archive/2026.php#2026 (github.com) for details.

Under the hood

• Pinned the base image in Dockerfile.build and Dockerfile.dev to php:8.5.12-apache so the patched runtime is used explicitly rather than relying on the floating 8.5-apache tag.

How to update

Follow instructions on this page: https://faved.to/docs/getting-started/updating.

To confirm the container is on the patched runtime:

docker compose exec faved-web-app php -v

It should report PHP 8.5.12 or later.

If you run Faved outside Docker, update your system PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later).

Full Changelog: https://github.com/denho/faved/compare/v2.10.0...v2.10.1