logoalt Hacker News

andrelaszlo • today at 2:41 PM • 3 replies • view on HN

Just pulled the new matomo that was published on dockerhub 26 minutes ago, thinking it has the patched PHP version:

  # docker pull matomo:latest
  latest: Pulling from library/matomo
  Digest: sha256:6e63589d31ec653f78e029084d21488640fdbbd9a42c96c872098f42c8678a02
  Status: Image is up to date for matomo:latest
  docker.io/library/matomo:latest
  
  # docker run --rm matomo:latest php --version
  PHP 8.4.26 (cli) (built: Oct 21 2026 00:31:19) (NTS)
  Copyright (c) The PHP Group
  Built by https://github.com/docker-library/php
  Zend Engine v4.4.26, Copyright (c) Zend Technologies
      with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
The PHP build is from today, which is doubly misleading. 8.4.27 is the patched release, not 8.4.26. I wonder how many people will pull this image thinking they're good to go online again.

Replies

andix • today at 5:17 PM

The "official" PHP Docker images turned out to be a shit show tody. Seems like many maintainers fell for it and published updates that aren't really updates.

I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.

➕ show 2 replies
teekert • today at 2:45 PM

Same goes for

    $ docker pull wordpress:fpm && docker image inspect wordpress:fpm --format '{{.Created}}' && docker run --rm wordpress:fpm php --version
    fpm: Pulling from library/wordpress
    Digest: sha256:c6d271a445510a3e08cfcc487750ac014f4464165ad6df6356da04680be8e907
    Status: Image is up to date for wordpress:fpm
    docker.io/library/wordpress:fpm
    2026-10-21T01:27:06.695704995Z
    PHP 8.3.35 (cli) (built: Oct 21 2026 00:33:17) (NTS)
    Copyright (c) The PHP Group
    Zend Engine v4.3.35, Copyright (c) Zend Technologies
      with Zend OPcache v8.3.35, Copyright (c), by Zend Technologies
I guess they were planning an update for today, for a moment the 8.2.35 threw me, but .35 is patched on 8.2, unpatched on 8.3 :)
trvz • today at 2:45 PM

If you need Docker to run PHP software you're beyond any help already.

➕ show 2 replies