# Coolify rushes security fixes to all v4 lines after PHP2Shell and dependency vulnerabilities Coolify 4.4.7 and four older-line backports shipped October 21 to address critical dependencies, including PHP2Shell. The current line also updates Node.js, cloudflared and Sentinel; older branch patches do not contain every 4.4.7 security fix. Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage. - Status: Active - Published: 2026-10-22T06:16:22+13:00 - Updated: 2026-10-22T06:16:22+13:00 - Categories: Cloud & Infrastructure, Hosting, Deployment & DevOps - Tags: PHP-FPM, security - Canonical HTML: https://beyondthe.news/dossiers/coolify-v4-security-backports-php2shell-node-cloudflared-sentinel-october-2026 ## What changed On October 21, 2026 Coolify shipped security updates across every stable v4 line: 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7. All patch embedded PHP to 8.4.27 against PHP2Shell CVE-2026-109618 and CVE-2026-109619. The latest 4.4.7 also updates Node.js to 24.22.1, cloudflared to 2026.10.3 for the eMudhra certificate compromise and Sentinel to 1.1.2 for CVE-2026-111943. The maintainers explicitly say earlier-line backports do not contain all security fixes in 4.4.7. ## Why it matters Coolify is a self-hosted deployment control plane, so vulnerabilities in its bundled PHP, terminal server, tunnels or monitoring agent can affect the management surface even when hosted application dependencies are up to date. The branch-specific matrix gives operators a clear immediate patch target, while the unequal backport coverage creates a practical decision: apply a supported branch patch now, then plan a move to the latest line. Security patching should include verifying the control plane, not just application containers. ## Five patched branches Coolify's release notes list v4.0.1 for v4.0.x, v4.1.3 for v4.1.x, v4.2.1 for v4.2.x, v4.3.24 for v4.3.x and v4.4.7 for v4.4.x. These backports address PHP2Shell; the project recommends moving to 4.4.7 because some other security changes are not backported. ## What 4.4.7 fixes beyond PHP The current line includes Node.js 24.22.1 security fixes, cloudflared 2026.10.3 for the eMudhra trust compromise and Sentinel 1.1.2 for CVE-2026-111943. The PHP dependency is updated to 8.4.27, one of PHP's official fixed builds. The release does not claim all prior versions were actively exploited. ## Upgrade routes differ by branch On stable v4.4, Coolify directs administrators to the dashboard's Settings → Update flow. Older stable v4.0–4.3 lines use its documented patch script. Beta, RC and nightly installations require a separate migration path through a stable patched release before updating. Treat remotely fetched privileged scripts as sensitive: verify the official release documentation and inspect scripts according to local change-control policy before execution. ## Validate the whole control plane After updating, verify the running Coolify version, PHP runtime, terminal server, cloudflared and Sentinel components. Check dashboards, deployments, agent connections and tunnel connectivity. Take backups and preserve rollback options; patching a compromised system does not itself guarantee attacker removal. ## Evidence and limits Official GitHub release notes for 4.4.7 and 4.2.1 establish the patch matrix and component versions. PHP's own advisory confirms the PHP2Shell fixes. The actual prevalence of attacks against Coolify instances is not established by these release notes. ## Key details - Security releases published October 21, 2026. - Patched v4 lines: 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7. - All lines patch PHP2Shell through PHP 8.4.27. - 4.4.7 also updates Node.js 24.22.1, cloudflared 2026.10.3 and Sentinel 1.1.2. - Older backports omit some additional 4.4.7 security fixes. - Project recommends 4.4.7 when feasible. ## Builder takeaways - Identify the exact Coolify branch and apply its security release promptly. - Prefer 4.4.7 for broader dependency security coverage where migration is feasible. - Check the official upgrade procedure and privileged patch scripts before running them. - Verify management-plane component versions and operational health after upgrade. ## What to watch - Follow-up Coolify security advisories and backports. - Sentinel CVE-2026-111943 detail and remediation confirmation. - Regression reports and migrations from older stable branches. ## Uncertainties - No confirmed Coolify-specific exploitation rate is supplied. - Exact older-branch omissions beyond the release note's warning require version-by-version validation. - Deployment-specific migration risks depend on the running branch and customisations. ## Sources - [Coolify v4.4.7 release](https://github.com/coollabsio/coolify/releases/tag/v4.4.7) — Coolify Maintainers · primary security release · 2026-10-21T00:00:00+13:00. Security matrix and current-line dependency versions. - [Coolify v4.2.1 security backport](https://github.com/coollabsio/coolify/releases/tag/v4.2.1) — Coolify Maintainers · primary backport release · 2026-10-21T00:00:00+13:00. Older branch backport scope and warning. - [Security advisory: Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-1) — PHP Security Team · primary security advisory · 2026-10-21T00:00:00+13:00. CVEs, patch matrix, SAPIs, backports and partial mitigations.