[tyrsson]

Why

Two PHP RCE advisories published 2026-10-22 are fixed in 8.5.12:

• GHSA-w8hw-w9fx-j79w: an OOM during request startup leaves request memory half initialized, and shutdown then branches on it. Unauthenticated RCE, validated over HTTP against mod_php, FPM considered susceptible.
• GHSA-6wmf-4rv5-p3rp: worker globals can point at a freed request heap, and the next request consumes the stale state. Full RCE.

The tooling image was pinned at 8.4.24, three patch releases behind both fixes.

What changed

Item	Before	After
PHP_VERSION	8.4.24	8.5.12
COMPOSER_VERSION	2	2.10.3
pcov	unpinned	1.0.12
xdebug	unpinned	3.5.3

Composer 2.10.3 carries the fix for CVE-2026-40176 (Perforce command injection).

Service images move from floating tags to exact versions:

Image	Before	After
mysql	9.7	9.7.4 (CVE-2025-15467, CVSS 9.8)
phpmyadmin	latest	5.2.3 (PHP 8.3.36 base)
mailpit	latest	v1.31.6

Published ports bind to 127.0.0.1. The application runs on the host and connects over loopback, so nothing needed a reachable interface.

Why exact versions rather than floating tags

A floating tag cannot receive a Renovate patch PR: an imprecise tag gives Renovate nothing to compare, so image patches were invisible. Exact versions plus the shared Renovate docker rule (merged in webinertia/.github#31) is what makes them automatic. Floating tags also bypass the required-CI gate, since nothing in the dependency graph tracks a Docker image.

Verification

• docker compose config resolves with host_ip: 127.0.0.1 on every mapping.
• Image built and run: PHP 8.5.12, pcov 1.0.12, xdebug 3.5.3, intl, pcntl, zip.
• Test suite passes on 8.5.12.

Note

MYSQL_DATABASE and image tags changed, so an existing mysql-data volume should be dropped once with docker compose down -v.

Database user normalized

MySQL previously ran root-only, and both phpMyAdmin and the integration tests authenticated as root with an empty password. This repo now matches the rest of the fleet: user webware, password webware, database webware.

The fixture loader issues CREATE DATABASE IF NOT EXISTS and DROP DATABASE IF EXISTS, so the app user needs that database. Verified on mysql:9.7.4 that MYSQL_USER receives GRANT ALL ON \webware`.*`, which covers both statements.

Two latent divergences removed with it:

• The two test suites carried their own root and webware_log_test fallbacks, which webware-acl and webware-phpdb do not have.
• The phpunit.xml.dist env block order now matches those repos.

Verification

Full suite on host PHP 8.5.11 against real MySQL 9.7.4, fresh volume:

119 / 119 (100%)
OK (119 tests, 209 assertions)

Schema and log table created by MysqlFixtureLoader as webware, and grants read GRANT ALL PRIVILEGES ON webware.* TO webware@%``.

Note

MYSQL_DATABASE changed, so an existing mysql-data volume must be dropped once with docker compose down -v.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!