Update PHP for your self-hosted Kimai
Self-host Kimai. Security update
On 20 October 2026, the PHP security team announced an emergency security release that fixes two critical vulnerabilities in PHP itself, both rated 9.2 out of 10. Kimai Docker images were updated a few hours after the official PHP patch was released. What does it mean for self-hosters?
Security updates done!
We’ve been tracking this closely since the evening of 20 October and have taken precautions across our infrastructure. All Kimai systems were updated within a few hours of the official PHP release. Learn more on our blog.
What is important for Kimai + Docker?
The relevant PHP base images were updated. To get the fix, pull the latest image and restart your container. Make sure you use a tag that still receives updates.
Running Kimai on a server?
If Kimai runs natively on a server (installed via SSH), we recommend updating to one of the patched PHP versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your repositories don’t provide the updated packages yet, please use the repository of Ondřej Surý for Debian and Ubuntu.
The quickest way to stay updated is following Kimai on social media. Please follow us on LinkedIn or Mastodon for more #SelfHostKimai!
Kimai
You are receiving this email because you subscribed for Kimai Newsletter.
Kevin Papst, Schweidlgasse 46/1/13, 1020 Vienna, Austria
Contact us: [email protected]