We have released an updated Passwork Docker image with patched PHP (CVE-2026-109618 and CVE-2026-109619). If you run Passwork 7 or later in Docker, update today.
The update restarts the containers, so Passwork will be unavailable for a few minutes. It doesn’t change the database or Docker volumes.
Passwork Cloud was updated right after the fixes were released. No action is required from Passwork Cloud customers.
Docker installation
Run these commands on the server, in the directory that contains docker-compose.yml.
Check the PHP version:
docker exec -it passwork_php php -vPull the new image and recreate the PHP containers:
docker compose pull
docker compose up -d --force-recreate php-fpm cronCreate a backup and confirm that the dump appears in ./backup/:
./db-backup.shThe first line of the output must show PHP 8.3.36 or newer.
If the version is older, the new image was not applied. Contact Support rather than leaving the server in that state.
After the check, open the Passwork web interface and confirm that it loads.
Manual installation
If you installed Passwork 7 or later without Docker, update PHP to the patched release (8.3.36 or newer), restart PHP, and confirm the version with php -v.
OS-specific instructions are in the PHP update guides.