Repository navigation
fix(docker): pin PHP 8.2.35 for php2shell CVEs - #60
Merged
Merged
Conversation
Pin the base image to php:8.2.35-fpm, which fixes CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE). The floating 8.2-fpm tag left the production image on whatever PHP was current at the last build in August. Also disable session.upload_progress in the production image as defense in depth for CVE-2026-109619; Laravel doesn't use native PHP sessions, so nothing relies on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Pins the PHP base image to
php:8.2.35-fpm, which fixes CVE-2026-109618 and CVE-2026-109619 ("php2shell"). Both are unauthenticated RCEs in PHP itself, rated 9.2, and they're already being exploited in the wild. Any PHP-FPM setup serving web traffic is exposed, so this is a PHP version bump and not an app code change.We were on the floating
php:8.2-fpmtag, and images only build on pushes tohermes. The last one was from #59 on Aug 14, so prod is still running PHP from August. Pinning the exact version means the build can't land on a cached or stale8.2-fpmlayer, and the image gets a new SHA tag so theIfNotPresentpull policy actually picks it up.Changes
php:8.2-fpm→php:8.2.35-fpmin both stages ofdocker/production/Dockerfile.prodand indocker/development/Dockerfile.session.upload_progress.enabled=0inconf.d/zz-security.ini. That's the code path behind CVE-2026-109619, and an unauthenticated POST can reach it before Laravel runs. Laravel keeps its own sessions and never uses PHP's native ones, so nothing depends on it. It's only there in case an older image gets deployed by mistake.Advisory: https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
QA Notes
qa_req 0 I already tested this on the test cluster.
After the deploy,
php -vin a restarters pod should show 8.2.35, andphp -r 'echo ini_get("session.upload_progress.enabled");'should print0.