Repository navigation
fix: PHP2Shell ini mitigations across all images (CVE-2026-109619) - #20
Merged
Merged
Conversation
Disable session.upload_progress on the 8.2, 8.3 and 8.4 images as well (8.5 already had it), and set fatal_error_backtraces=0 on the 8.5 images, both per the GHSA-6wmf-4rv5-p3rp advisory. Relabel the existing upload progress comment from CVE-2026-109618 to CVE-2026-109619, where the advisory lists it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR: Interim hardening until the patched PHP images (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) are published: disables
session.upload_progresson every image and setsfatal_error_backtraces=0on the 8.5 images, per the official advisories.Changes
session.upload_progress.enabled = 0added to 8.2, 8.2-debian, 8.3, 8.3-frankenphp, 8.4 and 8.4-frankenphp (8.5, 8.5-frankenphp and 8.5-www already had it from fix(8.5): disable session.upload_progress (CVE-2026-109618) #19).fatal_error_backtraces = 0added to 8.5, 8.5-frankenphp and 8.5-www. The advisory says this removes the stale-state producer used by the confirmed RCE (PHP 8.5 only setting).memory_limit = -1, the primary config mitigation for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w).Verification
php -n -c): both settings read back as0, no startup warnings.Follow-ups (not in this PR)
8.5-wwwpinsFRANKENPHP_VERSION=1.13.0; Docker Hub stopped rebuilding that tag on 2026-10-09, so it won't pick up PHP 8.5.12. Bump to 1.13.1 (rebuilt daily).session_use_strict_modeandzend_detect_unicodeuse underscores, so PHP ignores them (strict session mode is off).apc.rfc1867andopcache.fast_shutdownare no-ops.References
🤖 Generated with Claude Code