[travismolick]

Summary

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are two critical bugs in PHP core. They let an unauthenticated attacker run code on the server. PHP fixed them on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

This PR adds two of the PHP project's recommended stopgaps for CVE-2026-109619 to .docker/app/php-overrides.ini, as defense in depth:

• fatal_error_backtraces = 0 blocks the confirmed fatal error backtrace path (PHP 8.5).
• session.upload_progress.enabled = 0 blocks the confirmed session upload progress path. Laravel uses its own session handling, not PHP's native upload progress, so the app should not be affected.

The real fix is upgrading PHP. The app image uses the floating php:8.5-fpm tag, which now points to 8.5.12, so the image CI builds after this merges includes the patched PHP.

memory_limit stays at 64M. The PHP project suggests memory_limit=-1 as a stopgap for CVE-2026-109618, but an unlimited limit lets one request use up all memory, and the upgrade fixes the bug properly.

Testing

• Ran a php:8.5-fpm container with the new ini mounted. It reports PHP 8.5.12, session.upload_progress.enabled=0 and fatal_error_backtraces=0.

Deployment notes

• Docker installs: after the new image is published, pull it and restart.
• Manual installs: upgrade PHP through the OS packages to a fixed version, then restart php-fpm. Until then, set the same two values in php.ini or the FPM pool and restart every worker; ini_set() and .user.ini do not work for this. PHP 8.1 and older get no fix.
• Sail dev: run docker compose build --pull.

References

• https://www.php.net/
• https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/

[Earthmark]

Lgtm in terms of possibly being a partial mitigation.