[coder]

Patches PHP in the universal image for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).

Why

Every published universal tag ships PHP 8.5.0 and 8.4.15 from mcr.microsoft.com/devcontainers/universal. Upstream main still pins those versions in src/universal/.devcontainer/devcontainer.json, so the weekly rebuild won't pick up a fix. The fixed releases are 8.5.12 and 8.4.27 (released 2026-10-21).

Default use isn't exploitable (CLI only; no PHP web server is configured or started), but it becomes exploitable if someone runs php -S or php-cgi and exposes the port.

What

• Removes /usr/local/php/* and rebuilds PHP 8.5.12 and 8.4.27 from source with the upstream PHP feature script, pinned to a commit. This keeps the same layout, configure flags, Xdebug, php group ownership, and current symlink as the base image.
• Leaves Composer alone (/usr/local/bin/composer, independent of the PHP install dir).
• Restores /etc/profile.d/00-restore-env.sh after the script, since the script rewrites it and our user-rename step edits it later.
• Versions are build args, so this can be dropped (or bumped) once upstream ships the fix. Upstream fix: devcontainers/images#2055; drop this step once it merges and a new universal:noble image is published.

Verification

Built locally with docker build -f images/universal/ubuntu.Dockerfile (PHP step adds ~4 min; image 11.7 GB to 11.9 GB):

• php -v: PHP 8.4.27 ... with Xdebug v3.5.3 (current -> 8.4.27, same default as today's image, which points current at 8.4.15)
• /usr/local/php/8.5.12/bin/php -v: PHP 8.5.12
• No 8.5.0 / 8.4.15 binaries remain on the filesystem
• composer --version: 2.10.3
• coder user can still write to /usr/local/php (group php), and /etc/bash.bashrc / /etc/zsh/zshrc have a single PHP PATH entry
• dprint check passes

Merging triggers the build workflow on main, which publishes new tags ahead of the Monday scheduled run.