From 9b97e101ffed7a8020fd620ea09f7288583544ab Mon Sep 17 00:00:00 2001
From: Vasyka <vasyka.moraru@gmail.com>
Date: Tue, 27 Oct 2026 09:17:22 +0000
Subject: [PATCH] security: patch PHP2Shell RCE CVE-2026-109618 +
 CVE-2026-109619
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin base image from floating dunglas/frankenphp:1-php8.4 to
dunglas/frankenphp:1.13.4-php8.4.27 which ships PHP 8.4.27.

CVE-2026-109618: OOM memory corruption → unauthenticated RCE (CVSS 9.2)
CVE-2026-109619: use-after-free between requests → unauthenticated RCE (CVSS 9.2)
Both affect PHP-FPM, mod_php, FrankenPHP, php-cgi. Exploited in the wild.
Fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 1df698e..137fe59 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,8 @@ COPY public ./public
 RUN npm run build
 
 # ─── Stage 3: Runtime (FrankenPHP + PHP 8.4) ──────────────────
-FROM dunglas/frankenphp:1-php8.4 AS runtime
+# Pinned to 1.13.4-php8.4.27 — fixes PHP2Shell RCE (CVE-2026-109618, CVE-2026-109619)
+FROM dunglas/frankenphp:1.13.4-php8.4.27 AS runtime
 WORKDIR /app
 
 # Install PHP extensions Laravel needs