Repository navigation
fix(php): update amd64 packages for critical RCE vulnerabilities - #20
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the pinned amd64 PHP packages for CVE-2026-109618 and CVE-2026-109619, including FPM, CLI, common and bundled extensions. Package URLs, SHA256 checksums, keys and dependency references are updated together. Also updates the transitive PHP 8.4 packages pulled in by PEAR and refreshes the architecture-independent php-common/php-xml packages for both architectures to replace deleted upstream URLs.
20261021.122+debian121.gbpe0bcd420261021.121+debian121.gbpe9c42820261021.88+debian121.gbp250f7c20261021.57+debian121.gbp7636b920261021.27+debian121.gbp1a3e8aThe PHP 7.2 and 7.4 package changelogs explicitly record: "Backported from 8.2.35" and "[CVE-2026-109618, CVE-2026-109619]: Avoid state corruption via bailout." These were verified in
/usr/share/doc/php7.2-common/changelog.Debian.gzand/usr/share/doc/php7.4-common/changelog.Debian.gzinside the new packages from Sury PHP 7.2 and Sury PHP 7.4.Architecture limitation: Sury's live Bookworm arm64 indexes still list the previous package revisions at the time of this update. Arm64 PHP runtime packages remain unchanged and unpatched for these vulnerabilities; they require a follow-up once upstream publishes the builds. This PR does not make the multi-architecture images fully patched.
Validation: downloaded and verified 91 amd64 package records (including the architecture-independent packages also used by arm64); verified SHA256, package identity and direct runtime dependency constraints against the locked packages. Verified every lock dependency reference resolves, arm64 PHP runtime versions are unchanged, and
git diff --checkpasses. The first CI run exposed a stale php-xml URL; the follow-up commit refreshes those defaults packages and transitive PHP packages. All five amd64 image targets now build successfully locally with Bazel 8.4.2 using the Brainhive registry. The updated GitHub Actions run is pending.