Repository navigation
fix(security): require PHP 8.5.12 for CVE-2026-109618 / CVE-2026-109619 - #74
Merged
Merged
Conversation
PHP 8.5.12 fixes two critical unauthenticated RCE bugs (OOM corruption and stale global state). The production image runs mod_php, the deployment the PHP security team rates highest risk. - Dockerfile.prod: fail the build when the floating php:8.5-apache base is below 8.5.12 (PHP_MIN_VERSION build arg), so a stale cache or lagging mirror can't publish a vulnerable runtime. - docker-image.yml: pull: true so buildx always re-resolves the base. - prod-php.ini: session.upload_progress.enabled=0 and fatal_error_backtraces=0, the advisory's mitigations for the CVE-2026-109619 paths. The panel uses neither. - Install wizard: warn (not block) below 8.5.12, since distros may backport the fix. - Docs: prerequisites + Docker upgrade notes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PHP published an urgent advisory today (php.net, 2026-10-21): CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated remote code execution bugs fixed in PHP 8.5.12. The risk is highest under
mod_php, which is exactly what our production image runs (php:8.5-apache).This PR makes sure we never ship a vulnerable runtime and adds the advisory's mitigations.
docker/Dockerfile.prod: the runtime stage fails the build when PHP is belowPHP_MIN_VERSION(default8.5.12). Thephp:8.5-apachetag floats, so without this a stale cache or lagging mirror would silently publish an unpatched image.docker-image.yml:pull: trueonbuild-push-actionso buildx always re-resolves the base image.docker/php/prod-php.ini:session.upload_progress.enabled = 0andfatal_error_backtraces = 0, the advisory's mitigations for the CVE-2026-109619 attack paths. The panel uses neither feature. They must live in the ini (notini_set()), which is why they are here.2.1.23-srcdslab.Heads-up
As of this PR, Docker Hub's
php:8.5-apachestill resolves to 8.5.11. Until the official image is rebuilt, the:mainimage build will fail on purpose at the floor check instead of publishing a vulnerable image. Re-run the workflow once Docker Hub ships 8.5.12.Anyone running the panel on a tarball install should upgrade the host PHP now (or apply the vendor's backport).
Test plan
php:8.5-apache(8.5.11): fails with floor 8.5.12, passes with floor 8.5.0prod-php.iniloaded in the base image: both directives read0php -l+ PHPStan oninstall/pages/page.3.php: no errorsdocker-image.ymlgreen once Docker Hub publishes 8.5.12@cmer81 @maxijabase: security fix, please review when you can.
🤖 Generated with Claude Code