Alpine Linux has released four simultaneous updates—3.21.9, 3.22.7, 3.23.7, and 3.24.3—addressing critical security vulnerabilities across five core components. Notably, the updates fix a significant PHP remote code execution (RCE) vulnerability in versions 3.23 and 3.24, while older branches are not affected due to using earlier PHP versions. The updates also include fixes for issues in musl libc, zlib, and ca-certificates, with the latter addressing the eMudhra CA key compromise. Users are encouraged to update their systems immediately, particularly those running on PHP versions before 8.2.35, and to plan for migration from version 3.21, which will reach end-of-support in November 2026
Alpine 3.21.9, 3.22.7, 3.23.7 and 3.24.3 Security Releases, Patches Critical PHP RCE
Alpine Linux issued four simultaneous stable point releases on today: 3.21.9, 3.22.7, 3.23.7, and 3.24.3 are fixing security issues across five core components. The updates address the eMudhra CA key compromise in ca-certificates, a musl regex heap overflow (CVE-2026-107891), a large OpenSSL advisory dominated by DoS flaws, and a zlib heap overflow (CVE-2026-85091). The most serious fix is a critical "php2shell" unauthenticated RCE pair (both 9.2/Critical) that ships only on the 3.23 and 3.24 branches, since older branches pin an unaffected PHP version. With v3.21 reaching end-of-support on November 1, 2026, the team says it's time to update now and plan a migration.
