Repository navigation
fix: 修复 PHP RCE 漏洞 CVE-2026-109618 / CVE-2026-109619 - #1
Merged
Merged
Conversation
- Move to Alpine 3.24 and PHP 8.3; Alpine 3.16 and PHP 8.1 are EOL and will not receive the fix - Add the FPM pool mitigations from the PHP security advisory until Alpine ships PHP 8.3.36 - Install Composer from the official image instead of the pinned installer hash, which no longer matches - Use nobody:nobody for chown, busybox rejects the dot separator - Replace the inherited trafex CI with a GHCR build that smoke-tests the mitigations, warns while PHP is unpatched and rebuilds daily
nginx serves /var/www/html/public since the Laravel support change, so the bundled phpinfo page was unreachable and the smoke test got a 404.
Alpine has not shipped PHP 8.3.36 yet. Rebuild community/php83 from aports at the latest upstream release (sha256 checked against php.net) in a build stage and install it from that local repository, keeping the stock php83 package names and paths. CI reads the latest 8.3 release from php.net, builds natively on amd64 and arm64 runners with the PHP stage cached, and checks the image runs that version. With PHP patched, drop the temporary FPM mitigations.
gitlab.alpinelinux.org answers GitHub runners with HTTP 418.
abuild fetch verifies against the sha512 of the old release. Fetch the tarball directly, check it against the php.net sha256, then let abuild checksum regenerate the sums.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
2026-10-21 PHP 发布安全公告：CVE-2026-109618 / CVE-2026-109619，可导致未认证远程代码执行，PHP-FPM 受影响，修复版本为 8.3.36 / 8.4.27 / 8.5.12。
公告：https://www.php.net/archive/2026.php#2026-10-21-5
本镜像原为 Alpine 3.16 + PHP 8.1，两者均已 EOL，不会获得修复；Alpine 和 Docker Hub 官方镜像目前也尚未发布 8.3.36。
改动
community/php83APKBUILD 以最新上游版本自行编译（源码 sha256 与 php.net 校验），从本地仓库安装；包名与路径（/etc/php83、php-fpm83）保持不变，安装后校验 PHP 版本composer:2镜像复制（原安装脚本哈希已失效）chown使用nobody:nobody（新版 busybox 不支持点号分隔）src/public/，与 nginx root 一致（此前首页 404）trafex/*）：ghcr.io/paraparty/php-nginx（latest、PHP 版本号、sha-*）注意
本 PR 在 Claude Code 协助下完成。