Critical PHP security update: what it means for Kimai users

Update 21 Oct - 19:30

The update is done. A big thank you to the PHP team and everyone else involved in this release, and thank you for your patience during this wild day.

Kimai Cloud

All Kimai Cloud systems were updated within minutes after the official PHP releases were published. You don’t need to do anything, every environment is running on the patched PHP version.

• The countermeasures we deployed during the last 24 hours put us in a good position, so we were able to keep all systems up and running before and during the update. Most of the settings recommended in the CVE advisory were already active on our infrastructure, because security has always been one of our top priorities.
• Between the publication of the CVEs and the availability of the updated packages, some requests failed for a short time. This was caused by the additional strict safety measures we had put in place, and the errors disappeared as soon as the updated packages were installed.

On-Premise

If Kimai runs natively on a server (installed via SSH), we recommend updating to one of the patched PHP versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

If the repositories of your distribution don’t provide the updated packages yet, we recommend the repository of Ondřej Surý for Debian and Ubuntu.

Docker

It took a few hours until the relevant PHP base images were updated. As soon as they were available, we started building and pushing the updated Kimai Docker images. The updated images are available under the tags 2.70.1, latest, apache, 2 and stable.

Make sure you use a tag that still receives updates. Check the list of supported tags in our documentation.

You can verify the PHP version of your image with the following command (replace kimai with the image name you are using):

docker run kimai php -v

The output should look like this:

PHP 8.3.36 (cli) (built: Oct 21 2026 16:06:16) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

Announcement 21 Oct - 10:00

What happened

On 20 October 2026, the PHP security team announced an emergency security release that fixes two critical vulnerabilities in PHP itself, both rated 9.2 out of 10. The release is scheduled for 21 October 2026 at 14:00 UTC.

The vulnerabilities are not in Kimai’s code. They are in the PHP runtime, so every PHP application worldwide is potentially affected. Updating Kimai alone won’t fix this: PHP itself has to be updated on every server that runs it.

What we are doing

We’ve been tracking this closely since the evening of 20 October and have taken precautions across our infrastructure. Our team is on standby and will apply the official PHP fix as soon as it’s published. We’ll update this post as the situation develops.

Important for Kimai Cloud customers

You don’t need to do anything to get the fix. We’ll update all Kimai Cloud servers right after the PHP security release is published.

During the day, you may notice short interruptions or occasional errors while we apply additional security measures and install the updates. We’re sorry for the inconvenience. The security of our platform is our top priority, so this time we can’t wait for a planned maintenance window.

If something doesn’t work as expected, contact us at support@kimai.org.

Self-hosted Kimai with Docker

The PHP runtime is part of our Docker image. Once PHP publishes the fix, we’ll release updated Kimai images, and you can update your installation by pulling the new image. We’ll post the exact image tag in https://github.com/kimai/kimai/pull/6262 as soon as it’s available.