Security Advisory: PHP 8.5.12 Update

Published October 21, 2026 · Applies to self-hosted Fair TPRM v2.6.2

Summary: Two PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on October 21, 2026 at about 14:00 UTC. They affect PHP versions before 8.5.12. We have rebuilt the Fair TPRM v2.6.2 Docker image on PHP 8.5.12 (previously 8.5.11), and our Docker registry has been serving the updated image since approximately 14:30 UTC on October 21, 2026. If you host Fair TPRM yourself, pull the updated image and recreate your containers.

Using a hosted instance or a free trial? You don't need to do anything. All hosted instances and trials are already running PHP 8.5.12.

Who needs to act

  • Self-hosted installations running the dockerregistry.fairtprm.com/fairtprm:v2.6.2 image that was pulled before the update are still on PHP 8.5.11 and should update now.
  • Hosted instances and trials are already updated. No action is needed.

The image tag hasn't changed. It is still v2.6.2, so running docker pull again fetches the rebuilt image. Restarting your existing containers is not enough: they have to be recreated from the new image.

How to update

Run these commands on the host that runs Fair TPRM. The default install path is /data/docker/fairtprm. If you installed somewhere else, use that directory instead.

  1. Change to your Fair TPRM directory

    cd /data/docker/fairtprm

  2. Pull the updated image

    This downloads the latest v2.6.2 image, which is built on PHP 8.5.12.

    docker pull dockerregistry.fairtprm.com/fairtprm:v2.6.2

  3. Recreate the containers

    This replaces the running containers with new ones built from the updated image. Your data volumes are kept.

    docker compose up -d --force-recreate

  4. Verify the PHP version

    docker compose exec open-tprm php -v

    The first line of the output should report PHP 8.5.12:

    PHP 8.5.12 (cli) ...

All steps at once

cd /data/docker/fairtprm
docker pull dockerregistry.fairtprm.com/fairtprm:v2.6.2
docker compose up -d --force-recreate
docker compose exec open-tprm php -v

Troubleshooting

  • Still shows PHP 8.5.11: the containers are probably still running the old image. Run docker pull again, check that it reports a newer image being downloaded, then repeat the --force-recreate step.
  • The pull fails: check that the host can reach dockerregistry.fairtprm.com and that any proxy or firewall rules allow it.
  • Your service has a different name: if you changed the service name in docker-compose.yml, replace open-tprm in the verification command with your service name.

Timeline

  • October 21, 2026, ~14:00 UTC: CVE-2026-109618 and CVE-2026-109619 publicly disclosed for PHP versions before 8.5.12.
  • October 21, 2026, ~14:30 UTC: Fair TPRM v2.6.2 image rebuilt on PHP 8.5.12 and promoted in our Docker registry.
  • October 21, 2026: All hosted instances and trials updated.

Need help?

If you have trouble updating, contact us. To report a security issue, see our Vulnerability Disclosure Policy.