Edit: and it's live now 1hour 43minutes after. Edit 2x: well I spoke too soon. not actually live - the 8.4.27 tag appeared, but it's still an empty shell with no amd64 image to build from. Maybe other architectures can be built from though. Ugh. Now we're at 2hours 24minutes in. I know process steps take time/can't be rushed, and I know people mean well and surely some are unappreciated for what they do. That said: this debacle is making me want to reassess my deployment pipeline choices.

how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 52 minutes past due. (posting comment again, because the other thread i posted in was marked as dupe.)

▲

andrin 4 hours ago | parent | next [-]

They even committed the fixed version to the repo, but it seems no images where pushed: https://github.com/docker-library/php/commit/e3eaff845f7a9f7...

Edit: Seems like GitHub has issues with merging PRs: https://github.com/docker-library/official-images/pull/22541

▲

sunaookami 3 hours ago | parent | next [-]

Ugh these comments on GitHub. Don't people know when it's best to just post nothing? "516 hidden items"

	▲	teekert 3 hours ago \| parent [-]
		Have you ever experienced a "Reply-all storm"?

▲

maaarghk 4 hours ago | parent | prev [-]

It went a few seconds ago. I was also surprised they didn't have advance access but thinking about it, with the whole thing being a public Github pipeline, it's unclear how they could have achieved it whilst simultaneously keeping the patch private. Is there precedent?

▲

3 hours ago | parent | prev | next [-]

[deleted]

▲

amykhar 2 hours ago | parent | prev | next [-]

Images are there for docker now, but pecl has decided to have issues . ARGH

▲

adlpz 3 hours ago | parent | prev | next [-]

I have zero internal info, just guessing, but there's a PR from 5min ago asking to add someone as a reviewer for PHP images:

https://github.com/docker-library/official-images/pull/22544

Maybe the guy that has to click OK is asleep?

▲

asimovDev 3 hours ago | parent | prev | next [-]

they have a long process with multiple build steps before the images reach the registry.

https://github.com/docker-library/faq#an-images-source-chang...

▲

spenvo 2 hours ago | parent | prev | next [-]

And now, at 2hrs 55mins past the PHP release, the amd64 image is available. Although it appears that the servers hosting the image are getting hugged to death because I can't actually download it.

	▲	yurishimo an hour ago \| parent [-]
		Yepp, we're seeing the Debian images now for 8.4.27

▲

jMyles 4 hours ago | parent | prev | next [-]

Yeah, I was very surprised to wake up just now and find docker still vulnerable.

▲

adlpz 3 hours ago | parent | prev [-]

Out now!

https://hub.docker.com/_/php/tags

EDIT: 25min later, nope.

▲

bowersbros 3 hours ago | parent [-]

That's placeholders for images, you can't actually pull them yet.

https://hub.docker.com/layers/library/php/8.5.12-fpm/images/...

▲

nuil 3 hours ago | parent [-]

Any eta, when they will be available?

	▲	reddalo 2 hours ago \| parent \| next [-]
		Now they should be actually available and pullable! The only problem is that it took 3 hours with a huge security problem already exploited in the wild.
	▲	tmstieff 2 hours ago \| parent \| prev \| next [-]
		They are being backfilled now starting from the 8.0 images it looks like.
	▲	snlhuis087 2 hours ago \| parent \| prev [-]
		[dead]