From a4e4d1fd7c9cc9f63fe586b9784772509050b54e Mon Sep 17 00:00:00 2001 From: Angel de la Torre Date: Thu, 22 Oct 2026 08:12:46 -0700 Subject: [PATCH] fix(docker): pin PHP 8.2.35 for php2shell CVEs Pin the base image to php:8.2.35-fpm, which fixes CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE). The floating 8.2-fpm tag left the production image on whatever PHP was current at the last build in August. Also disable session.upload_progress in the production image as defense in depth for CVE-2026-109619; Laravel doesn't use native PHP sessions, so nothing relies on it. --- docker/development/Dockerfile | 2 +- docker/production/Dockerfile.prod | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/docker/development/Dockerfile b/docker/development/Dockerfile index e0cb3566fe..f073d75ff4 100644 --- a/docker/development/Dockerfile +++ b/docker/development/Dockerfile @@ -3,7 +3,7 @@ FROM golang:bullseye AS go RUN GOBIN=/usr/bin go install github.com/go-task/task/v3/cmd/task@v3.43.3 # This is the docker for restarters. It's used from docker-compose. -FROM php:8.2-fpm +FROM php:8.2.35-fpm # Install dependencies RUN apt-get update && \ diff --git a/docker/production/Dockerfile.prod b/docker/production/Dockerfile.prod index 4e5ffca526..344dcdb242 100644 --- a/docker/production/Dockerfile.prod +++ b/docker/production/Dockerfile.prod @@ -4,7 +4,7 @@ RUN GOBIN=/usr/bin go install github.com/go-task/task/v3/cmd/task@v3.43.3 # Multi-stage build for Restarters production image # Build stage -FROM php:8.2-fpm AS builder +FROM php:8.2.35-fpm AS builder # Install build dependencies in a single layer with cleanup RUN apt-get update && \ @@ -60,7 +60,7 @@ RUN php artisan lang:js --no-lib resources/js/translations.js && \ rm -rf node_modules # Production stage -FROM php:8.2-fpm AS production +FROM php:8.2.35-fpm AS production # Install minimal runtime dependencies RUN apt-get update && \ @@ -88,6 +88,10 @@ RUN install-php-extensions pdo_mysql pcntl bcmath zip xmlrpc intl gd && \ # ----------------------------------------------------------- RUN mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" +# Laravel doesn't use native PHP sessions, so upload progress tracking is +# unused. Disabled as defense in depth for CVE-2026-109619. +RUN echo "session.upload_progress.enabled=0" > "$PHP_INI_DIR/conf.d/zz-security.ini" + # Set working directory WORKDIR /var/www