Repository navigation
chore: bump PHP to 8.5.12 and pin service images - #104
Merged
Merged
Conversation
Two PHP RCE advisories were published on 2026-10-22, both fixed in 8.5.12: GHSA-w8hw-w9fx-j79w An OOM during request startup leaves request memory half initialized, and shutdown then branches on it. Unauthenticated RCE, validated over HTTP against mod_php, and FPM is considered susceptible. GHSA-6wmf-4rv5-p3rp Worker globals can point at a freed request heap, and the next request consumes the stale state. Full RCE. The tooling image was pinned at 8.4.24, three patch releases behind, so neither fix was reachable. This also pins what the build resolved implicitly, so a rebuild cannot silently change it: COMPOSER_VERSION 2 to 2.10.3, which carries the fix for CVE-2026-40176 PCOV_VERSION 1.0.12 XDEBUG_VERSION 3.5.3 Backing service images move from floating tags to exact versions: mysql:9.7 to 9.7.4 (CVE-2025-15467, CVSS 9.8) phpmyadmin:latest to 5.2.3 (PHP 8.3.36 base, same RCE fixes) axllent/mailpit:latest to v1.31.6 A floating tag also cannot receive a Renovate patch PR, because an imprecise tag gives Renovate nothing to compare. Exact versions plus the shared Renovate docker rule is what makes service patches automatic. Published ports bind to 127.0.0.1. The application runs on the host and connects over loopback, so nothing required a reachable interface. This removes LAN and VPN reach to MySQL, phpMyAdmin and Mailpit.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Two PHP RCE advisories published 2026-10-22 are fixed in 8.5.12:
The tooling image was pinned at 8.4.24, three patch releases behind both fixes.
What changed
PHP_VERSION8.4.248.5.12COMPOSER_VERSION22.10.31.0.123.5.3Composer 2.10.3 carries the fix for CVE-2026-40176 (Perforce command injection).
Service images move from floating tags to exact versions:
9.79.7.4(CVE-2025-15467, CVSS 9.8)latest5.2.3(PHP 8.3.36 base)latestv1.31.6Published ports bind to
127.0.0.1. The application runs on the host and connects over loopback, so nothing needed a reachable interface.Why exact versions rather than floating tags
A floating tag cannot receive a Renovate patch PR: an imprecise tag gives Renovate nothing to compare, so image patches were invisible. Exact versions plus the shared Renovate docker rule (merged in webinertia/.github#31) is what makes them automatic. Floating tags also bypass the required-CI gate, since nothing in the dependency graph tracks a Docker image.
Verification
docker compose configresolves withhost_ip: 127.0.0.1on every mapping.PHP 8.5.12,pcov 1.0.12,xdebug 3.5.3,intl,pcntl,zip.Note
MYSQL_DATABASEand image tags changed, so an existingmysql-datavolume should be dropped once withdocker compose down -v.