What changed
On October 21, 2026 Coolify shipped security updates across every stable v4 line: 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7. All patch embedded PHP to 8.4.27 against PHP2Shell CVE-2026-109618 and CVE-2026-109619. The latest 4.4.7 also updates Node.js to 24.22.1, cloudflared to 2026.10.3 for the eMudhra certificate compromise and Sentinel to 1.1.2 for CVE-2026-111943. The maintainers explicitly say earlier-line backports do not contain all security fixes in 4.4.7.
Why it matters
Coolify is a self-hosted deployment control plane, so vulnerabilities in its bundled PHP, terminal server, tunnels or monitoring agent can affect the management surface even when hosted application dependencies are up to date. The branch-specific matrix gives operators a clear immediate patch target, while the unequal backport coverage creates a practical decision: apply a supported branch patch now, then plan a move to the latest line. Security patching should include verifying the control plane, not just application containers.
Five patched branches
Coolify's release notes list v4.0.1 for v4.0.x, v4.1.3 for v4.1.x, v4.2.1 for v4.2.x, v4.3.24 for v4.3.x and v4.4.7 for v4.4.x. These backports address PHP2Shell; the project recommends moving to 4.4.7 because some other security changes are not backported.
What 4.4.7 fixes beyond PHP
The current line includes Node.js 24.22.1 security fixes, cloudflared 2026.10.3 for the eMudhra trust compromise and Sentinel 1.1.2 for CVE-2026-111943. The PHP dependency is updated to 8.4.27, one of PHP's official fixed builds. The release does not claim all prior versions were actively exploited.
Upgrade routes differ by branch
On stable v4.4, Coolify directs administrators to the dashboard's Settings → Update flow. Older stable v4.0–4.3 lines use its documented patch script. Beta, RC and nightly installations require a separate migration path through a stable patched release before updating. Treat remotely fetched privileged scripts as sensitive: verify the official release documentation and inspect scripts according to local change-control policy before execution.
Validate the whole control plane
After updating, verify the running Coolify version, PHP runtime, terminal server, cloudflared and Sentinel components. Check dashboards, deployments, agent connections and tunnel connectivity. Take backups and preserve rollback options; patching a compromised system does not itself guarantee attacker removal.
Evidence and limits
Official GitHub release notes for 4.4.7 and 4.2.1 establish the patch matrix and component versions. PHP's own advisory confirms the PHP2Shell fixes. The actual prevalence of attacks against Coolify instances is not established by these release notes.