From 59221ad4cd91f968be3d37bcc906362f1be58da4 Mon Sep 17 00:00:00 2001 From: Renn F Date: Wed, 21 Oct 2026 17:45:46 +0200 Subject: [PATCH] fix(docker): pin the PHP base image to 8.3.36 PHP 8.3.36 fixes CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution flaws in PHP that serves web requests. The example images run PHP's built-in web server, so the floating 8.3 tag could still resolve to an unpatched build; this pins the patched release. --- examples/advanced_app/Dockerfile | 2 +- examples/simple_app/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/advanced_app/Dockerfile b/examples/advanced_app/Dockerfile index 5c6f09e..9d99ac3 100644 --- a/examples/advanced_app/Dockerfile +++ b/examples/advanced_app/Dockerfile @@ -7,7 +7,7 @@ WORKDIR /app COPY composer.json composer.lock ./ RUN composer install --no-interaction --no-progress -FROM php:8.3-cli +FROM php:8.3.36-cli RUN useradd --create-home --uid 1000 guard diff --git a/examples/simple_app/Dockerfile b/examples/simple_app/Dockerfile index 6bba2e3..babbc2a 100644 --- a/examples/simple_app/Dockerfile +++ b/examples/simple_app/Dockerfile @@ -7,7 +7,7 @@ WORKDIR /app COPY composer.json composer.lock ./ RUN composer install --no-interaction --no-progress -FROM php:8.3-cli +FROM php:8.3.36-cli RUN useradd --create-home --uid 1000 guard