Vasyka/autocrm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: patch PHP2Shell RCE CVE-2026-109618 + CVE-2026-109619

Browse Source 
Pin base image from floating dunglas/frankenphp:1-php8.4 to
dunglas/frankenphp:1.13.4-php8.4.27 which ships PHP 8.4.27.

CVE-2026-109618: OOM memory corruption → unauthenticated RCE (CVSS 9.2)
CVE-2026-109619: use-after-free between requests → unauthenticated RCE (CVSS 9.2)
Both affect PHP-FPM, mod_php, FrankenPHP, php-cgi. Exploited in the wild.
Fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vasyka
2026-10-27 09:17:22 +00:00
parent 16fcdb41ed
commit 9b97e101ff
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+2 -1
View File
@@ -26,7 +26,8 @@ COPY public ./public
RUN npm run build RUN npm run build
# ─── Stage 3: Runtime (FrankenPHP + PHP 8.4) ────────────────── # ─── Stage 3: Runtime (FrankenPHP + PHP 8.4) ──────────────────
FROM dunglas/frankenphp:1-php8.4 AS runtime # Pinned to 1.13.4-php8.4.27 — fixes PHP2Shell RCE (CVE-2026-109618, CVE-2026-109619)
FROM dunglas/frankenphp:1.13.4-php8.4.27 AS runtime
WORKDIR /app WORKDIR /app
# Install PHP extensions Laravel needs # Install PHP extensions Laravel needs