diff --git a/battybirdnet-pi/CHANGELOG.md b/battybirdnet-pi/CHANGELOG.md
index b9b91dbfec..cc843c7ebf 100644
--- a/battybirdnet-pi/CHANGELOG.md
+++ b/battybirdnet-pi/CHANGELOG.md
@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 - Local disks: `localdisks` can now mount a single folder of a disk with `disk/folder` (e.g. `sda1/public` or `NAS/public`, mounted at `/mnt/<disk>/<folder>`). Existing values are unchanged.
 - Migrate legacy add-on configuration map names to current app configuration terminology.
 ## 2026.02.28 (28-02-2026)
diff --git a/battybirdnet-pi/Dockerfile b/battybirdnet-pi/Dockerfile
index 17143cdb4d..56f9970d09 100644
--- a/battybirdnet-pi/Dockerfile
+++ b/battybirdnet-pi/Dockerfile
@@ -114,6 +114,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*
diff --git a/battybirdnet-pi/config.yaml b/battybirdnet-pi/config.yaml
index 66067c1ef0..19e1dfb1fc 100644
--- a/battybirdnet-pi/config.yaml
+++ b/battybirdnet-pi/config.yaml
@@ -118,5 +118,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/battybirdnet-pi
 usb: true
-version: "2026.02.28"
+version: "2026.10.31"
 video: true
diff --git a/birdnet-pi-zach/CHANGELOG.md b/birdnet-pi-zach/CHANGELOG.md
index a07bc892bb..666cea032a 100644
--- a/birdnet-pi-zach/CHANGELOG.md
+++ b/birdnet-pi-zach/CHANGELOG.md
@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 ## 2026.10.28.1 (28-10-2026)
 - Fix: restarting the services no longer leaves a previous `daily_plot.py` or recording loop running next to the new one. `restart_services.sh` now clears leftover `daily_plot.py`, `birdnet_recording.sh`, and `ffmpeg`/`arecord` recorders writing to `StreamData` once the recorder is stopped (port of the birdnet-pi fix for #3152)
 - Fix: an unreachable audio source (RTSP host switched off, missing soundcard) no longer causes a restart loop with growing RAM. The monitoring service now reports the silent source instead of restarting when there is nothing queued to analyze, and limits the static `analyzing_now.txt` restart path to once every 30 minutes
diff --git a/birdnet-pi-zach/Dockerfile b/birdnet-pi-zach/Dockerfile
index 2101ac8141..83a9714c4e 100644
--- a/birdnet-pi-zach/Dockerfile
+++ b/birdnet-pi-zach/Dockerfile
@@ -120,6 +120,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*
diff --git a/birdnet-pi-zach/config.yaml b/birdnet-pi-zach/config.yaml
index c9afed20e8..760cc34502 100644
--- a/birdnet-pi-zach/config.yaml
+++ b/birdnet-pi-zach/config.yaml
@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi-zach
 usb: true
-version: "2026.10.28.1"
+version: "2026.10.31"
 video: true
diff --git a/birdnet-pi/CHANGELOG.md b/birdnet-pi/CHANGELOG.md
index 9e2f20cf75..8966ea0bff 100644
--- a/birdnet-pi/CHANGELOG.md
+++ b/birdnet-pi/CHANGELOG.md
@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 ## 2026.10.26.1 (26-10-2026)
 - Fix: WebUI service actions (System Controls buttons, "Restart services", the chart restart after saving settings) work again. Since 2026.07.10-1 the build stripped `sudo` from every BirdNET-Pi script, so these ran `systemctl` as php-fpm's `caddy` user: the service-control buttons no longer matched the WebUI's allow-list (which still expects `sudo systemctl ...`) and were ignored, and the `systemctl` replacement looked for the running services in `/tmp/run` instead of root's `/run`, so it could neither see nor stop them. It also turned `sudo -u <user> ...` into a bare `-u <user> ...` in `config.php` (species list, test notification). `sudo` is kept again; `caddy` and `pi` already have passwordless sudo in the image
 
diff --git a/birdnet-pi/Dockerfile b/birdnet-pi/Dockerfile
index 4b986d5553..625a7fa87f 100644
--- a/birdnet-pi/Dockerfile
+++ b/birdnet-pi/Dockerfile
@@ -116,6 +116,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*
diff --git a/birdnet-pi/config.yaml b/birdnet-pi/config.yaml
index 5c1d07b492..b2788de212 100644
--- a/birdnet-pi/config.yaml
+++ b/birdnet-pi/config.yaml
@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.10.26.1
+version: "2026.10.31"
 video: true