Running the Patched PHP 8.3.36 on Ubuntu 20.04 Servers with Docker
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Hrih News: A developer documents running the patched PHP 8.3.36 on two production Ubuntu 20.04 Laravel servers by running PHP-FPM from Docker's official image while keeping the host's nginx and other services.
Score
0.67total under rubric v2.0
- Significance0.55
- Reader interest0.71
- Audience breadth0.41
- Practical relevance0.87
- Substantiated0.78
- Technical depth0.93
- New information0.86
- Counts against: Promotional0.09
- Counts against: Overclaim0.14
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.49 | 0.45 | 0.70 | 0.55 | 0.25 | +0.25 | +0.137 |
| Reader interest | 0.57 | 0.70 | 0.85 | 0.71 | 0.28 | +0.20 | +0.141 |
| Audience breadth | 0.42 | 0.40 | 0.42 | 0.41 | 0.02 | +0.10 | +0.041 |
| Practical relevance | 0.92 | 0.80 | 0.88 | 0.87 | 0.12 | +0.15 | +0.130 |
| Substantiated | 0.84 | 0.72 | 0.78 | 0.78 | 0.12 | +0.10 | +0.078 |
| Technical depth | 1.00 | 0.90 | 0.90 | 0.93 | 0.10 | +0.10 | +0.093 |
| New information | 0.92 | 0.70 | 0.95 | 0.86 | 0.25 | +0.10 | +0.086 |
| Promotional | 0.03 | 0.12 | 0.12 | 0.09 | 0.09 | −0.15 | −0.013 |
| Overclaim | 0.14 | 0.15 | 0.12 | 0.14 | 0.03 | −0.15 | −0.021 |
| Sum of contributions | +0.673 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.673 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 2 matches source · 3 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
PHP fixed CVE-2026-109618 and CVE-2026-109619 on October 21, 2026, in PHP 8.3.36 and the matching 8.2.35, 8.4.27 and 8.5.12 releases.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “PHP fixed the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 on October 21, 2026, in PHP 8.3.36 and the matching 8.2.35, 8.4.27 and 8.5.12 releases”
The source says No passage could be compared.
Source cited by the article: github.com/php/php-src/security-advisories/GHSA-w8hw-w9fx-j79w
Couldn’t checkNumber
Both vulnerabilities allow remote code execution through requests to the site.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Both allow remote code execution, which means an attacker can run their own code on the server through requests to your site”
The source says No passage could be compared.
Source cited by the article: github.com/php/php-src/security-advisories/GHSA-w8hw-w9fx-j79w
Couldn’t checkDate
On October 21 the ondrej/php PPA published PHP 8.3.36 for Ubuntu 24.04 and 22.04 but nothing for 20.04; the last PHP 8.3 build for 20.04 was 8.3.21 in May 2025, listed as deleted.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On October 21 the PPA published 8.3.36 for Ubuntu 24.04 and 22.04. For 20.04 it has nothing. The last PHP 8.3 build for 20.04 was 8.3.21 in May 2025”
The source says No passage could be compared.
Source cited by the article: launchpad.net/~ondrej/+archive/ubuntu/php
Matches sourceDate
Ubuntu ended standard security maintenance for 20.04 in May 2025.
The cited source says the same thing.
The article says “Ubuntu ended standard security maintenance for 20.04 in May 2025”
The source says “20.04 LTS Ubuntu 20.04 LTS Released: Apr 2020 | Standard security maintenance May 2025 With Ubuntu Pro”
Source cited by the article: ubuntu.com/about/release-cycle
No source givenDate
Ubuntu Pro keeps patching Ubuntu's own 20.04 packages until May 2030.
The article gives no link or citation for it.
The article says “Ubuntu Pro keeps patching Ubuntu's own 20.04 packages until May 2030”
The source says No source to compare with.
No source givenVersion
Ubuntu's own 20.04 archive only ships PHP 7.4.
The article gives no link or citation for it.
The article says “Ubuntu's own 20.04 archive only ships PHP 7.4”
The source says No source to compare with.
Matches sourceVersion
The official image's zz-docker.conf makes PHP-FPM listen on port 9000 on all interfaces.
The cited source says the same thing.
The article says “The image also ships a zz-docker.conf that makes PHP-FPM listen on port 9000 on all interfaces, as the official Dockerfile shows”
The source says “echo '; default listen address for easy override in later php-fpm.d/*.conf files'; \ echo 'listen = 9000'; \ } | tee php-fpm.d/docker.conf”
Source cited by the article: github.com/docker-library/php/blob/master/8.3/bookworm/fpm/Dockerfile
No source givenNumber
Running PHP-FPM in the container added about 5 to 10 ms per page; three pages took 109, 102 and 98 ms on the host socket and 113, 111 and 111 ms through the container.
The article gives no link or citation for it.
The article says “The container cost me about 5 to 10 ms per page”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 24 Oct 2026, 08:54 UTC. It played no part in the ranking.