Publish Server images on PHP 8.3.36 for the critical PHP RCE advisory (CVE-2026-109618, CVE-2026-109619) #591

Activity

1. rmcdaniel commented on Oct 21, 2026

   

   rmcdaniel

   on Oct 21, 2026

   MemberAuthor

   More actions

   General owns this public Server correction and is treating it as the current security priority. The upstream PHP advisory is verified directly: the 8.3 fix is 8.3.36, and configuration reductions do not complete the repair. Existing cancellation #585 and SDK source qualification continue independently.

   Release identity correction to the acceptance wording: do not overwrite immutable published version tags. Deliver new compatible patched releases for the supported 2.9 and 2.10 lines, with exact image digests and tested PHP versions, then update ordinary rolling aliases through the release workflow. Existing historical/frozen images remain their original bytes and are not called patched.

   Current source uses Apache/mod_php with automatic POST parsing disabled. The configuration follow-through must preserve the documented binary transport boundary as well as JSON limits; blindly imposing an 8 MiB POST ceiling must not break valid large binary uploads. Disable upload-progress tracking before request startup, retain explicit edge/body controls, and verify actual HTTP handler settings plus normal JSON/binary/health/worker behavior in an isolated candidate. No production exploit test is required or authorized here.

   The full-repair image gate is an immutable base reporting PHP 8.3.36 or later on the supported line, verified inside the published CLI and HTTP runtime. If an official base remains unavailable, a verified upstream-source build is the fallback, with source signature/checksum and rebuilt extensions proven. A source-only version string or cached rebuild is insufficient. General retains source/release/installed acceptance; no native/shared/frozen/package changes are included.
2. rmcdaniel

   added

   bugSomething isn't workingSomething isn't working

   kind:defectA public product behavior is incorrectA public product behavior is incorrect

   priority:P1High-priority product or release riskHigh-priority product or release risk

   on Oct 21, 2026
3. rmcdaniel commented on Oct 21, 2026

   

   rmcdaniel

   on Oct 21, 2026

   Last edited by rmcdaniel

   MemberAuthor

   More actions

   The one-time 2.9.12 security backport #603 is merged at 471c8fad733a5ee89b66a9abfd897656c7fb4555, with whole 7595f32bb3e80a3beb005ce55c5fc3243e11559c identical to qualified candidate 311bf1a2cf17649c415abf0bc5f6118939444dbe. Normal PHP/source, repository, Helm/kind and boundaries pass. New immutable tag 2.9.12 points to the merge; protected Release 39655882328 is queued. Application, dependency references, native/shared/runner/OpenAPI and frozen source remain unchanged from 2.9.11. Its Dockerfile, keyring and PHP settings match merged #593 exactly.

   All three source-release contracts, package-authority regression, 27 Helm publication controls and 12 focused PHP release contracts / 129 assertions pass. Three minor-alias counterfactuals fail against the prior scripts and pass after correction. This release can update only 2.9, rechecks newer 2.9 patches before promotion, and preserves 2 / latest. Its tag cannot republish chart 0.2.1; current main's chart/default remains on 2.10. The normal all-alias path is unchanged unless the maintenance scope is explicitly selected.

   The Sonar maintenance baseline fails because the organization cannot access non-main branch analysis under its current plan. The exact error was read. Keep the original failure and existing main-only triggers; do not claim a maintenance gate pass. The byte-identical PHP build correction was analyzed on main, and the small publication diff has explicit maintainer review plus its new functional regressions. No profile, threshold, private visibility or subscription is changed.

   The preceding chart gate correctly rejects changed contents under chart 0.2.1. The corrected source explicitly preserves that chart and all its consumers byte for byte; its preservation counterfactual fails the old generator. Four source-release controls, 28 chart/publication controls and the committed-source immutable-chart check pass. Normal exact #603 PHP/contracts/chart/boundary checks also pass before merge. Both lines' actual published-image acceptance remains open.

   Server 2.10.1 protected Release 39637101549 failed at its cold ARM build limit. Qualified workflow-only #605 is merged, and fresh protected recovery 39654639711 is queued while preserving the same immutable source/tag. Both lines' actual published-image acceptance remains open. No patched published digest has been handed off yet. Earlier failures remain failed, and no live production probe is performed.
4. rmcdaniel commented on Oct 21, 2026

   

   rmcdaniel

   on Oct 21, 2026

   Last edited by rmcdaniel

   MemberAuthor

   More actions

   Protected Release 39637101549 is FAILED. The actual cold multi-architecture build reaches its 45-minute step limit while still compiling signed PHP 8.3.36 on aarch64; the final source compilation line is ext/session/session.c. The exact-image verifier then correctly refuses the missing Docker Hub 2.10.1 manifest. No bare-image, TLS, catalog, rolling-alias, GitHub Release or chart acceptance ran. The failed attempt stays failed.

   The trusted publication step's correction is now qualified and merged through #605 at fb62c62 / whole cf034e2d, preserving immutable tag 2.10.1 → 7a02bbc and every image verification gate. Fresh protected Release 39654639711 is queued against that same source. No patched digest or provisioning handoff is claimed yet. The independent 2.9.12 backport #603 remains in its own source qualification.

   Recovery #605 qualifies candidate b3ba5fd5bd9c2f1f41ced91a86ca0a42326faf36 / whole cf034e2da09b92449ebd8eefcbfdb59b52c51f7b, incorporating the Rust-only main merge. Its one-file release-workflow change sets the bounded cold build to 120 minutes and the existing PHP compiler parallelism to four. Nine focused release contracts / 153 assertions and YAML parsing pass; exact normal PHP 39648080426, Sonar 39648080496, CodeQL and boundaries also pass before merge. Published-image qualification remains pending.
5. rmcdaniel commented on Oct 21, 2026

   

   rmcdaniel

   on Oct 21, 2026

   MemberAuthor

   More actions

   Published Server 2.9.12 security-image acceptance

   The immutable source is 471c8fad733a5ee89b66a9abfd897656c7fb4555. Protected Release 39655882328 completes successfully, including exact image identity, first-run readiness, source-free Compose, published database TLS/certificate refusals and protocol-catalog convergence. Its small publication evidence was independently read and matches the registries.

   Artifact	Digest
   Docker Hub / GHCR index	sha256:8ab0fa04a0e00f34e5a6054937dcfb26012772c635d354a814f71d0bd934f15e
   linux/amd64 child	sha256:015a0eb291e23976cea487b5e18d0b374ae70ed60f51ef243d8360c7c4cd7e29
   linux/arm64 child	sha256:f3b7337c9ff53797dcbf0b3c6d9b9b9d02430aa360a08aba8c7d4f21778aefb4

   Both registry manifests have those exact children. The downloaded amd64 image labels match the source, tag and current run/attempt. Core remains 2.8.0 / 2edaa6b1c6f45fcec4570813c2e741aadde92b3b, identical to 2.9.11. Existing chart bytes are unchanged. The publication advances only the 2.9 image alias; GitHub latest currently remains 2.10.1.

   Actual linux/amd64 verification

   • CLI and the actual Apache handler both report PHP 8.3.36. API health/readiness pass, an unauthenticated control-plane request gets 401, and the authenticated request succeeds.
   • Runtime settings: post_max_size=64M, upload_max_filesize=64M, session upload progress off, automatic POST parsing off and the normal API memory_limit=128M.
   • Exact 67,108,864-byte valid Avro upload and streaming fetch pass with SHA-256 af34359a1e77a159a86ab2c2db943ea24887692f5039553d76c8c0e815feb9e2. The JSON request limit and declared binary-size limit each return their canonical 413 refusal. A larger CLI memory allowance creates the synthetic input only; API memory stays unchanged.
   • Normally installed PHP SDK 3.2.0 / dfaae75a94b1d855379863799ce2c9a53f900f97 completes a real workflow/activity with exact int64/null/Unicode output. The stopped database independently proves three completed first-attempt tasks, six expected events, zero task repairs/failed jobs and the same single Avro registry size/hash.
   • Worker SIGTERM and API SIGWINCH each exit 0 without OOM. The first read-only stopped-state audit cannot open the legacy WAL-mode file from a read-only mount. After verifying all writers are stopped and no WAL/SHM files remain, the immutable read-only audit passes on the same database; no application data or assertion changes.

   Replace every API, worker, scheduler and bootstrap role with the pinned image and verify actual PHP in each role. Pulling an image alone does not update a running container. The separate 2.10 selection-cancellation fix and future activity-lease capability retain their own acceptance work. Server 2.10.1 image acceptance and its queued chart publication remain separate.
6. rmcdaniel commented on Oct 21, 2026

   

   rmcdaniel

   on Oct 21, 2026

   MemberAuthor

   More actions

   Published Server 2.10.1 acceptance

   Immutable source 7a02bbcec4d0f2c470d7556632da9f4d5d15b522, Core 2.9.0 / 2bc1ba0b57df34b74de02427d2225bd8e4dc6322. Docker Hub and GHCR agree on index sha256:4a1819ec6fed7d7bbbadfbc302251f37a226622c99f8950887f2bed5895f83df:

   • amd64: 184bc1ddf2f2776d8025a0fe1818a977d341d5eb3019148d15d0ede1538a0d46;
   • arm64: 6b0e948ad72af39bbe9d5cb008a6004622004ffe58fed50c84c724c52f3812ca.

   The protected image job in Release 39654639711 passes exact source/package/provenance, readiness, Compose, database TLS/certificate refusals and alias verification. Its separate chart 0.2.3 publication remains queued. The original cold-build run 39637101549 remains failed; no tag was moved. Actual independent runtime checks below are amd64, not an ARM runtime claim.

   Independent installed-image results

   • Actual CLI 8.3.36 and Apache 8.3.36 / apache2handler. POST/upload 64M; session upload progress and automatic POST parsing disabled; API PHP memory remains 128M.
   • Bootstrap, health/readiness and authenticated/unauthenticated responses pass.
   • A real 67,108,864-byte Avro upload/fetch preserves SHA-256 af34359a1e77a159a86ab2c2db943ea24887692f5039553d76c8c0e815feb9e2. JSON over 2 MiB and declared binary over 64 MiB receive their typed 413 refusals. Only the input-generating CLI uses a larger memory allowance.
   • Normally installed PHP SDK 3.2.0 / dfaae75a, Python 2.7.0, and Rust 4.2.0 each complete a genuine timer-winner / cancel-losing-activity workflow in default and named namespaces. All six originals return the exact int64/null/Unicode result within their original 30-second run/execution/observation budgets. Separate real late activity workers in both namespaces invoke zero callbacks. All consumer commands exit 0.
   • After every writer stops, the SELECT-only audit proves six completed runs, 24 tasks (18 completed first-attempt tasks and six cancelled activity tasks with zero claims), 54 events, zero repairs/failed jobs, and exactly one SelectionResolved, SelectionOperationCancelled, ActivityCancelled and WorkflowCompleted per run. The retained binary registry matches the original size/hash. The audit preserves the database file fingerprint.
   • API uses its published SIGWINCH stop signal and exits 0 / no OOM. The first bootstrap fixture mounted over the image's seeders and failed before business admission; a separate data-directory mount fixes that setup error. No PHP product defect or rescued business original is inferred.

   Both 2.10.1 release notes and 2.9.12 release notes now name the critical PHP CVEs, upgrade instructions and immutable digests. For runs already blocked by #583, upgrade first and follow the selected-run repair procedure. Upgrading does not undo an activity that already executed.

   This completes the published PHP-image and three-SDK acceptance for #583 and both security-image lines for #591. It does not qualify a native release/cutover, the queued chart, or the separate activity-lease release. The task-owned current-line image, database, dependencies and raw output are retiring; the borrowed 2.9.12 image and other owners' resources are preserved.
7. rmcdaniel

   closed this as completedon Oct 21, 2026