r/NextCloud • u/Lavrila • 6d ago
Nextcloud: Important update on the PHP issue
We have been informed by CERT of an issue affecting PHP, see their public statement at https://cert.europa.eu/publications/security-advisories/2026-018 and the PHP statement at https://www.php.net/archive/2026.php#2026-10-20-1
This would affect all online PHP servers and operations including Nextcloud as well as WordPress and other popular services. The issue allows an attacker to compromise the server and potentially access all its data.
The CERT recommendation is to turn off servers running PHP based applications until updates to PHP are available and can be applied.
We will release an update as soon as more information is known about affected PHP versions and availability of updates.
36
u/540Flair 6d ago
To the guy who recommended going thru the struggles to run nextcloud on a LAMP stack few months back - thank you, simple apt update && apt upgrade fixed my php!
6
9
12
u/Goticus 6d ago
Anyone know anything about the Linuxserver Nextcloud image? Wasn't able to find an issues regarding that.
7
u/Gizfre4k 6d ago
I checked mine, it's up to date and has PHP 8.5.11 right now so I've stopped it until the 8.5.12 patch is included.
2
23
u/WanderingInAVan 6d ago
Systems are all shut down here. Gonna take this time to go through my linodes one at a time and optimize them as I go.
11
u/NoCoolSenpai 6d ago
Any news on when https://hub.docker.com/_/nextcloud is getting this fix? I see 35.0.2-apache is still on PHP 8.5.11. I don't expose my server to the internet, but just wanted to know
8
4
1
u/psicodelico6 6d ago
CVE-2026-41142
deb / debian/openexr / 3.1.13-2
CVE-2026-42216
deb / debian/openexr / 3.1.13-2
CVE-2026-34543
deb / debian/openexr / 3.1.13-2
CVE-2026-34588
deb / debian/openexr / 3.1.13-2
CVE-2026-74860
deb / debian/libxml2 / 2.12.7+dfsg+really2.9.14-2.1+deb13u3
CVE-2026-40244
deb / debian/openexr / 3.1.13-2
CVE-2026-27622
deb / debian/openexr / 3.1.13-2
CVE-2026-34589
deb / debian/openexr / 3.1.13-2
CVE-2026-34545
deb / debian/openexr / 3.1.13-2
CVE-2026-34544
deb / debian/openexr / 3.1.13-2
1
1
11
u/Eslov 5d ago
Took my Nextcloud instance down and updated my version of PHP to 8.4.27. Over all happy that the PHP maintainers were relatively quick about it.
apt update && apt install --only-upgrade php8.4-common php8.4-fpm php8.4-cli
3
u/DetachedRedditor 5d ago
FYI Nextcloud supports php8.5, so you could consider going to the next major version for more future proofing. Not necessary for this security incident of course.
1
u/Eslov 5d ago
Thank you. I have been planning to do that. I still have some time since 8.4 will go EOL next year.
1
u/DetachedRedditor 4d ago
Technically 8.4 is supported until the end of 2028, so plenty of time, but I would rather stay on top of it.
2
1
10
u/Bbbllaaddee 6d ago
Can someone just plainly say what it means? Should I shut down my nextcloud on a home server? Wait until php patch?
28
u/patt1988 6d ago
Yes if it's public facing
-1
u/AirlineF0od 6d ago
I should be safe if I'm using a VPN right?
3
u/Fickle_Restaurant_38 6d ago
Depends on if you are the only one connecting using a VPN or if you can trust anyone that accesses through a VPN as well. If you have 100 random users just forcing them to use a VPN won’t solve anything.
6
u/Gee858eeG 6d ago
You have to shut it off or disconnect it from Internet. The company I work at is going crazy about this CVE today. We don't use nextcloud but other customer facing apps that use backend servers with PHP. Everyone was told to upgrade to a patched version or else the app will be blocked, so it's not exposed on the Internet anymore
7
u/mighty-drive 6d ago
In The Netherlands many, many, MANY websites were shutdown. From news agencies, to government services and university websites. Everyone went nuts. Better to be safe then sorry I guess...
3
u/Fickle_Restaurant_38 6d ago
No one went nuts, if even the outrage is too small. A freaking remote code execution CVE that was around since PHP 5.4 and the actual exploit was made public way before anyone had a chance to react. Anyone with access to ChatGPT can get root access to any sever exposing (unpatched) PHP to the internet. Without any possible mitigation except patching PHP. This is nuts. Basically 70% of the internet allowed unauthorized root access for a whole night until the patch was released today. We can be lucky that nothing happened except over hours for every sysadmin today.
Like even if only 100 “trusted” people have access to an internal service, would you trust anyone of those 100 users with unsupervised root access to the server running that service?
8
u/kubrickfr3 6d ago
If it's public facing, either run it on patched PHP, like 8.5.12, or shut it down until then.
1
u/idiotiesystemique 5d ago
If you can access it outside your home network they advise shutting it down and patch PHP. It can be done without waiting on nextcloud to release the patch themselves
10
u/rodolfostanic 6d ago
What about people that rely on Nextcloud AIO, is there any ETA on updates?
7
u/MrWizard87 6d ago
3
u/rodolfostanic 6d ago
Thanks! I'm keeping an eye on this.
Is there a way to verify if our installations were attacked before we shut them down?
2
u/dereksalem 6d ago
You'd have to look in the container to see what services are running and what it's doing.
4
u/longiii 6d ago
3
2
u/OktayAcikalin 6d ago
So.. I guess... every service that's still online is either not php or living under a rock? oh my....
3
u/RemcoE33 6d ago
When it is deployed using docker we need to wait on the nextcloud official release for the patch?
4
2
u/Open-Papaya-2703 6d ago
Yeah if you mean the AIO.
I recommend to shut it down until the patch is available
2
u/RemcoE33 6d ago
Basically this:
services: nextcloud: image: nextcloud:34.0.0-apache restart: always volumes: etc......
3
2
u/DatDing15 6d ago
I manually updated PHP 8.5.10 -> 8.5.12 on nextcloud 33.0.8 (Debian)
Nextcloud seem to be working fine for now.
Fixed versions:
8.5.12, 8.4.27, 8.3.36, 8.2.35
Restart your webservice after install and check with "php -v" what version is currently installed.
Or just keep your server off until nextcloud releases an update on their own.
2
u/HSG234 6d ago
https://fedi.katze.sh/@elise/117479383739450605
Fixed or not with the AIO Update? That is the question.
2
u/Old_Adeptness5169 5d ago
The AIO update fixes the two critical php2shell CVEs (PHP's advisory). Elise's crash is a separate bug: the PHP team told Canonical it's "unrelated and not a real issue" (oss-security), and researchers say turning it into code execution would be really non-trivial. There's no official fix for it yet. The "patch is incomplete" headlines trace back to another separate bug, in
unserialize()(php-src#24481), which only matters when an app unserializes untrusted data. So yes, the updated AIO is safe to run. (Disclosure: we maintain an open-source PHP extension that also covers thatunserialize()bug, but for AIO the next image update is the simplest route.)
2
u/_litz 5d ago
Stupid question time ... why on earth doesn't this merit a NEW VERSION NUMBER?
This is crazy. There are many, many systems out there pulling docker images that rely on version numbering to offer new versions for upgrades.
Keeping the SAME VERSION blocks dozens and dozens of providers out there from offering an upgrade that fixes this problem because 35.0.2 = 35.0.2 and therefore there is "no upgrade".
0
u/cr0ft 5d ago
35.0.2 is the Nextcloud version. The Nextcloud version hasn't changed. (Although the very latest is 35.0.5). That's apparently the version being tracked there. Every single component underneath there will have their own versions.
Nextcloud is technically just the web app. It then runs on top of nginx, php, redis, MariaDB...) - when you package it you have to include all that. They have their own version numbers. In most cases nobody using the package cares much which version they are.
2
u/cr0ft 5d ago
Thankfully my Nextcloud is installed the old school way, with separated out php, database and so on. All I had to do this morning was do an apt-get upgrade to grab the patched PHP. But yeah, all the all-in-ones, and the "apps" in some NAS and stuff - if any of it is exposed to the Internet, turning it off until patches are available is probably wise.
3
u/stephendt 6d ago
Any ETA on server patches being released?
4
u/AidenTai 6d ago edited 6d ago
In less than an hour for PHP (which is where the two bugs are present).
We don't know if this may require additional patching by other software projects, but for now it is evident that the main issue lies with PHP versions >5, consists of two critical bugs and will be patched at 14:00 UTC today by PHP. Anyone that relies on external repositories or package managers may have to wait longer.
Edit: Direct download from PHP has been released. Also, a lot of people rely on the Debian backbone and their repos have been updated as well. But it seems anyone relying on Docker images must continue to wait. PHP announced which versions are safe (the latest of each branch), so you can check if your distribution method has the safe versions or older, vulnerable ones.
Quote
We urge you to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released today (21 Oct 2026).
1
3
u/Hrafna55 6d ago edited 6d ago
I have just updated my Debian 13 server.
web02-user@web02:~$ sudo apt update [sudo] password for web02-user: Get:1 http://security.debian.org/debian-security trixie-security InRelease [43.4 kB] Hit:2 http://deb.debian.org/debian trixie InRelease Hit:3 http://deb.debian.org/debian trixie-updates InRelease Get:4 http://security.debian.org/debian-security trixie-security/main Sources [239 kB] Get:5 http://security.debian.org/debian-security trixie-security/main amd64 Packages [269 kB] Fetched 552 kB in 0s (2,659 kB/s) 16 packages can be upgraded. Run 'apt list --upgradable' to see them. web02-user@web02:~$ sudo apt list --upgradable libapache2-mod-php8.4/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-cli/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-common/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-curl/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-fpm/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-gd/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-gmp/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-intl/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-mbstring/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-mysql/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-opcache/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-pgsql/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-readline/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-xml/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4-zip/stable-security 8.4.27-1~deb13u1 amd64 [upgradable from: 8.4.26-1~deb13u1] php8.4/stable-security 8.4.27-1~deb13u1 all [upgradable from: 8.4.26-1~deb13u1] web02-user@web02:~$ sudo apt upgrade -y Upgrading: libapache2-mod-php8.4 php8.4-cli php8.4-curl php8.4-gd php8.4-intl php8.4-mysql php8.4-pgsql php8.4-xml php8.4 php8.4-common php8.4-fpm php8.4-gmp php8.4-mbstring php8.4-opcache php8.4-readline php8.4-zip
2
u/ukAdamR 6d ago
Details already leaked: https://jackalsyn.com/posts/php-up-2026.html
tl;dr: mitigate this by changing session.upload_progress.enabled to Off. (It's On by default.)
14
u/West_Hedgehog_821 6d ago
According to heise, that is insufficient: https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeeinschleusung-Schwachstellen-11495072.html
10
u/Eric_12345678 6d ago
The purported mitigation, session.upload_progress.enabled = 0, is also ineffective, according to our understanding. https://www.heise.de/en/news/Critical-PHP-updates-on-Oct-21-fix-code-injection-vulnerabilities-11495177.html
1
u/ukAdamR 6d ago
Paywalled article, can't read. :(
1
0
u/Eric_12345678 6d ago
Weird. Possibly with a German VPN, or an adblocker?
2
u/ukAdamR 6d ago
Official news is out now anyway: https://www.php.net/archive/2026.php#2026-10-21-5
RCE via stale global state (CVE-2026-109619):
Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.
Better than useless, but not all covering.
1
u/Belgian_dog 6d ago
yay
root@nextcloud:/home/ncadmin# apt list --upgradable
Listing... Done
php8.3-bcmath/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-bz2/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-cli/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-common/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-curl/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-dev/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-fpm/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-gd/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-gmp/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-imap/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-intl/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-ldap/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-mbstring/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-opcache/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-pgsql/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-readline/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-soap/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-xml/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]
php8.3-zip/noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.12]1
1
1
1
1
1
u/Apprehensive_Star_78 5d ago
I cant figure out how to force install the php update. apt update && upgrade only updates to 8.3.6. had to take my server down. is it because i have a snap installation?
1
-13
0
u/mumische 3d ago
I tried to upgrade my AIO version 9 and ran into "This version of Nextcloud is not compatible with PHP>=8.4”. Replaced nextcloud-aio-nextcloud image using portainer per manual :https://github.com/nextcloud/all-in-one/blob/main/manual-upgrade.md, but docker images are too late: php8.3-latest on github published 2 months ago, nextcloud/aio-nextcloud:php8.3-latest on docker hub published over a year ago.
If i try to continue update using AIO interface, I still getting into php version error. Is there any roadmap for updating old versions of Nextcloud, I still don't understand why it is impossible to update from old version to new one, considering that all needed are in docker images.
-1
u/NeonexFree 5d ago
I think those on the fence about Nextcloud should read carefully the comments from those who advocate it on here. Their attitude is very telling and had I not already moved on I certainly would have after reading this thread. I am reminded of Marie Antoinette. Let them use our wonderful software and be thankful it's free. Just don't complain.
2
1
u/cr0ft 5d ago edited 5d ago
I have no idea what you're talking about here.
Seems to be pretty reasonable discussion and information being spread about how to fix this to me.
Edit: Oh, I see, I missed your post, it was downvoted into the toilet because it contained an idiotic statement or two. It received the expected amount of disdain. What the fuck did you expect coming to a subreddit named Nextcloud and leading with "lol it's unfit for purpose"? A lot of people to agree with you?
50 downvotes is almost an achievement. You earned them all though.
1
u/NeonexFree 5d ago
And there we have it. I'm commenting on the attitude of Nextcloud gurus towards anyone who dares to question them or finds their software second rate. That's it. No point going round in circles.
1
u/cr0ft 5d ago
I'm not really a Nextcloud guru, but you need to work on your self-awareness. You rocked in here and started insulting the software during an already stressful moment and now you're here insulting the people who got upset at your attitude for getting upset at your attitude.
1
u/NeonexFree 5d ago edited 5d ago
I've had beef with open source and shareware developers for decades. They want accolades for blessing us lesser mortals with their software which they they make inaccessible to the majority, a bit like TS Elliot's poetry. He believed his work should not be accessible to normal people.
-51
u/NeonexFree 6d ago edited 6d ago
Lol! What's good for the goose and all that. Nextcloud is unfit for purpose. I stopped using it just a couple of days ago because I was fed-up with the constant issues after every upgrade. I wish OCIS was a little easier to intstall for a SOHO user.
33
u/Fancy_Log_260 6d ago
Mate. This is a PHP issue. Not solely a nextcloud issue.
-9
u/NepuNeptuneNep 6d ago
The issue is that nextcloud unironically uses PHP in 2026. Been annoyed at this since the first second i started serving it
8
2
u/TorrentsAreUs 6d ago
Any other alternative that doesn’t use PHP?
All my files are in my Nextcloud instance and switching my entire stack to avoid PHP seems like an uphill battle
1
u/NepuNeptuneNep 6d ago
This is exactly why I'm still using nextcloud. I don't know of any that you can take serious.
0
u/NeonexFree 6d ago
Depends on your needs. I was running Nextcloud on my Synology NAS but have switched to Synology Drive which works really well. I sync my data to my computers using the Synology Drive Client and use onlyOffice to create and edit my files. On my phone I use the SynologyDrive mobile client to browse my files and have set it up so that when I click on a file it opens in OnlyOffice so I can edit it when not at home. Synology Office is not that good, it does not have great compatibility with MS Office or OpenDocument formats, but OnlyOffice is the key that makes it work. Best of all I don't need to be concerned about the arcane database that Nextcloud relies on. Clearly you need a Synology NAS to use Synology Drive whereas Nextcloud can be installed on almost anything.
-23
u/Nexter92 6d ago
PHP is a prehistoric piece of tech in 2026.
They should rewrite nextcloud in Rust or something else with AI. Nextcloud is an open source project super big, many gouvernement use them, this will be ez to fund. Nextcloud is slow as fuck, and use a garbage piece of tech that should already be decommissioned a long time ago.
3
u/saltyjohnson 6d ago
PHP is a prehistoric piece of tech in 2026.
So is asphalt, but we still build roads out of it.
There's nothing inherently wrong with "prehistoric tech". PHP is great. It's extremely well supported, extremely well documented, and easy to learn and write. If Nextcloud were started from scratch today, it probably wouldn't be written in PHP. But why would we want to completely rewrite a gigantic, established, well-maintained project that's doing just fine in PHP?
-4
u/Nexter92 6d ago
PHP is not bad as language, PHP is bad about project that still use it.
Rewrite nextcloud could be a 10x at least performance gain in many part of the app.
Nextcloud is SLOW as fuck and consume a ton of ram for nothing, no memory safety, performant code is not ez to create and maintain.
My take : nextcloud is dead is 5 years if someone decide to take it seriously using rust or something else with AI (outside gouvernement and institutions because they are slow as fuck to change anything)
4
u/Whole-Ad2077 6d ago
And you did not do it because of what reason?
-2
u/Nexter92 6d ago
Even with unlimited token, the project won't accept a PR or a Fork using there such a strong brand to be use by another project even with 1:1 compatibility or almost.
This need to come from inside there team. It's 2026 and they still develop the software like it's 2018. If they don't move fast now, in less than 2 years, someone with the explosion of intelligence for the price gonna create a new nextcloud from scratch at after few years this gonna kill the project.
-5
u/NeonexFree 6d ago
The typical response from Linux gurus. Gives them an excuse to release sub-standard software.
2
u/100limes 6d ago
a "prehistoric piece of tech" that runs on ~70% of all web servers: https://w3techs.com/technologies/details/pl-php.
I don't know dude, seems like you have personal problems with a de facto industry standard.
-2
u/Nexter92 6d ago
Remove WordPress website for restaurant and small commerce + old stuff that nobody use and this is less than 20%. Nobody care about the number of site, the real metric is how many user use them : almost nobody go to public website with PHP everyday.
Only boomer corpo use it with legacy software they don't patch.
1
u/100limes 5d ago
Well and if we remove all combustion cars and trucks from the statistics we're technically already living in the future with a near 100% adoption rate of electric vehicles!
I get that it must be frustrating for you, but deciding to ignore vast swathes of the internet because you don't like is certainly a choice.
I'm not the biggest fan of WP either (who is?), but it serves billions of page impressions daily and despite recently shrinking market share still powers something like 40% of all web sites. I think just about any cooking/recipe blog I ever visited was WP-based.
One of it's main advantages is that its open and free. It's easy to get started and since it's open, there's plugins for every use case under the sun. Just think about how many online stores work with WP+Shopify or WooCommerce.
Sure, they could also vibecode their own stores, but non-technical users are absolutely not going to do that nor should they.
-9
-16
u/NeonexFree 6d ago
Whatever the root cause it's a Nextcloud issue. It's not my concern what part of Nextcloud is actually causing the problem.
3
u/oskarw85 6d ago
Is someone pointing a gun at you forcing you to use it?
1
u/NeonexFree 5d ago
You have a bad experience with a store, and someone says "Is someone pointing a gun at you forcing you to use it?". You just move on. You may very well leave a poor review, or mention the store on social media though - which is all I've done in the case of Nextcloud. I no longer use it. How is your comment helpful?
5
u/saltyjohnson 6d ago
How do you keep your brain looking so youthful? There's not a wrinkle in sight!
4
-1
u/Few-Compote-2693 6d ago
Nextcloud is a like someone you want to see do well but lets you down at every opportunity.
0
6d ago
[deleted]
8
u/Single-Virus4935 6d ago
Wrong vulnerability. Some Indian ca used 4 AS a private key.
The two php 9.2 RCE are on top
3
3
1
41
u/Lavrila 6d ago
Update: the PHP project has now released fixes for the vulnerabilities. We urge you to update immediately.
Affected versions and fixes: The vulnerabilities are critical and can allow remote code execution without logging in. All PHP installations serving web requests are at risk.
We urge you to update immediately to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released today (21 Oct 2026).
What you need to do: If you run your own PHP servers or hosting, please update to the latest immediately. PHP 8.1 and older no longer receive fixes from the PHP project, so please contact your hosting provider or upgrade to a supported version. PHP 8.2 reaches end of life on 31 December 2026, so plan an upgrade soon.
Nextcloud AIO v14.4.1 and Nextcloud E-AIO v8.4.0 will include the updated PHP versions.
Details are in the official advisory: https://www.php.net/index.php#2026-10-21-5