Repository navigation
Fix php2shell in all the v5 images (CVE-2026-109618, CVE-2026-109619) - #424
Merged
mistraloz merged 10 commits intoOct 22, 2026
Merged
Conversation
PHP 7.4, 8.0 and 8.1 are end-of-life: CVE-2026-109618 and CVE-2026-109619 (php2shell, CVSS 9.2) were only fixed with a source backport (PHP-x.y-CVE-2026-109618-109619 branches of php-src) that keeps the version number. The packages of packages.sury.org carry it, so a rebuild without cache is enough, no compilation from source. - Add a test checking that the images are not vulnerable: the version for PHP 8.2+, the zend_mm_safe_error_ex symbol added by the backport in every PHP SAPI (CLI, FPM, mod_php) for older versions - legacy-v5.yml: build without cache by default, run the vital tests (configurable input) before publishing, the other tests being informative, and publish every version/variant validated on all architectures even if others failed
Add a security note to the README and a Security updates page explaining how the maintained (8.2 to 8.5) and non-maintained (7.4, 8.0, 8.1) v5 images are fixed, how to check and update them, and that the v4 images are not fixed, with a link to the migration notes.
The page is specific to php2shell: rename it security-php2shell.md. Document the NodeJS variants that are no longer built (-node18, and -node20 on PHP 8.2+) and remain vulnerable, recommend a maintained NodeJS version and explain how to install another one on the fixed slim image with the NODE_VERSION ARG.
The -node18 and -node20 variants of the maintained PHP versions were no longer built, so they kept a PHP vulnerable to php2shell. Build them with the legacy workflow (new -legacy-node bake groups, only their NodeJS images are published), and add NodeJS 18 to the non-maintained PHP versions. Make the php2shell page and the README note go straight to what to do, add Watchtower as a way to apply the next fixes automatically, and remove the fpm built-in Apache note from the top of the README.
mistraloz
marked this pull request as draft
October 22, 2026 09:16
packages.sury.org publishes the fixed PHP packages for amd64 first, the arm64 ones can come days later. Until then, the arm64 builds fail the php2shell test and nothing is published, amd64 included. Add an allow_arm64_failure input to workflow.yml and legacy-v5.yml: the amd64 images are published, the X.Y tags keep their current arm64 image so that arm64 users are not broken, and the tags of the new PHP patch version only have amd64. amd64 failures still block the publication.
The fixed PHP packages are not yet published for arm64 by packages.sury.org. Say so in the README note, the php2shell page and the changelog, explain how to check an image and how to run the amd64 image on an arm64 host in the meantime.
mistraloz
changed the title
packages.sury.org does not provide php8.0-swoole and php8.1-swoole. The install then fell back to php-swoole, which installs PHP 8.5 and switches the php alternative to it: every following extension failed its check and the 8.0 and 8.1 images could no longer be built. Remove swoole from these versions, and fail the build of an extension whose package does not exist for the PHP version instead of installing the unversioned package.
When php<version>-<extension> did not exist, the install fell back to the unversioned php-<extension> package, which installs another PHP version (e.g. php-swoole installs PHP 8.5). Fail instead, and add the swoole removal to the changelog.
Since PHP comes from packages.sury.org, php-pear comes from Ubuntu
(1.10.13 instead of 1.10.16 from the PPA). On PHP 7.4, its pecl cannot
read the release metadata of event ("does not have REST xml
available"), so the 7.4 images could no longer be built.
Install event 3.1.6, the version of the published images, from its
archive URL. Only PHP 7.4 uses this extension: replace the symlink to
core with a real directory.
mistraloz
marked this pull request as ready for review
October 22, 2026 12:07
packages.sury.org has not published the fixed PHP packages for arm64 yet. Instead of publishing amd64 alone, the php2shell test only emits a GitHub warning for a vulnerable arm64 image, and still fails for amd64: the CI passes, the multi-arch images are published as usual and the arm64 status is documented. Simplify the legacy workflow accordingly: drop the vital_tests, no_cache and allow_arm64_failure inputs and use the build, test and publish steps of the main workflow (the CI runners start without build cache, so no_cache changed nothing there). Restore workflow.yml.
4 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
php2shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4 9.2): unauthenticated remote code execution in the PHP core, public exploits.
-node18, and-node20on PHP 8.2+) were no longer built: they are built again, so every v5 image gets the fix.test_php2shellPatchedonly emits a GitHub warning for a vulnerable arm64 image (it fails for amd64): the CI passes, the multi-arch images are published as usual, amd64 fixed and arm64 not yet, which the README and the php2shell page say. Once the warning is gone, a follow-up PR will turn it into an error and update the docs.This PR fixes/implements :
swooleremoved from PHP 8.0 and 8.1)Changes:
tests-suite/php-security-patches.sh(temporary): PHP 8.2+ must be at least the fixed release; on 7.4/8.0/8.1 every PHP SAPI of the image (CLI, PHP-FPM,mod_php) must contain thezend_mm_safe_error_exsymbol added by the backport. Error on amd64, warning on arm64.legacy-v5.yml(manual) now covers the 7 PHP versions: all the images of 7.4 to 8.1, and only the NodeJS 18/20 images of 8.2 to 8.5 (newphpXY-<variant>-legacy-nodebake groups). It runs the test suite before publishing, with the same build, test and publish steps asworkflow.yml.NODE_VERSIONARG, v4 images not fixed → migration, and Watchtower to apply the next fixes automatically. CHANGELOG and docs/contributing.md updated.legacy-v5.ymlrun of 21/10 failed on all of them):php8.0-swoole/php8.1-swoole:swooleis removed from PHP 8.0 and 8.1 (legacy versions). The install fell back tophp-swoole, which installs PHP 8.5 and switches thephpalternative to it:docker-install.shnow fails whenphp<version>-<extension>does not exist instead (no maintained extension relied on this fallback);php-pearnow comes from Ubuntu (1.10.13 instead of 1.10.16 from the PPA), whosepeclcannot read the metadata ofeventon PHP 7.4: it is installed from its archive (3.1.6, same version as the published images).Notes for the review:
7.4.33-v5-*,8.0.30-v5-*and8.1.34-v5-*tags will be overwritten by the fixed images (same PHP version).Release plan
legacy-v5.ymlmanually (workflow.ymlruns on the push) → amd64 fixed.Test plan (required)
test_php2shellPatched, with the vulnerable version in the message.php-security-patches.shpasses (and fails on the currently published8.1-v5-slim-cli). Fat cli images: build OK,php-security-patches.sh,php-extensions.shandphp-ini.shpass (16/16 each). Fat apache/fpm and arm64 are left tolegacy-v5.yml.php84-cli-legacy-nodebuilds, NodeJS 18.20.8 and 20.20.2 with PHP 8.4.27.php-security-patches.sh: passes on fixed amd64 images, fails on the published (vulnerable)8.1and8.4amd64 images, warns and passes on a vulnerable arm64 image (simulated: no arm64 emulation locally). actionlint: no error onlegacy-v5.yml.Checklist