From edf20f936a6677bb78cdf789c191549a6eabf196 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Sat, 24 Oct 2026 16:48:19 +0000 Subject: [PATCH] fix(universal): patch PHP for CVE-2026-109618 and CVE-2026-109619 The upstream devcontainers/universal base image still pins PHP 8.5.0 and 8.4.15, which are affected by PHP2Shell. Rebuild PHP 8.5.12 and 8.4.27 from source using the upstream PHP feature script, pinned to a commit, so the install layout matches the base image. --- images/universal/ubuntu.Dockerfile | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/images/universal/ubuntu.Dockerfile b/images/universal/ubuntu.Dockerfile index bbc9ede..5d332a6 100644 --- a/images/universal/ubuntu.Dockerfile +++ b/images/universal/ubuntu.Dockerfile @@ -15,6 +15,27 @@ RUN rm -R /opt/conda && \ # Install Chrome for AI Browser Testing RUN yes | npx playwright install chrome +# Rebuild PHP from source to patch CVE-2026-109618 and CVE-2026-109619 +# (PHP2Shell). The upstream universal image still pins PHP 8.5.0 and 8.4.15. +# This reuses the upstream PHP feature script (pinned to a commit) so the +# layout, configure flags, Xdebug, and the `current` symlink match the base +# image. Composer lives in /usr/local/bin and is left as is. Remove this step +# once the base image ships PHP 8.5.12 / 8.4.27 or newer. +ARG PHP_VERSION=8.5.12 +ARG PHP_ADDITIONAL_VERSIONS=8.4.27 +ARG PHP_FEATURE_COMMIT=94181c0188ce13b8c145ab114e887715d45bd982 +RUN cp /etc/profile.d/00-restore-env.sh /tmp/00-restore-env.sh && \ + rm -rf /usr/local/php/* && \ + curl -fsSL -o /tmp/php-install.sh \ + "https://raw.githubusercontent.com/devcontainers/features/${PHP_FEATURE_COMMIT}/src/php/install.sh" && \ + VERSION="${PHP_VERSION}" \ + ADDITIONALVERSIONS="${PHP_ADDITIONAL_VERSIONS}" \ + INSTALLCOMPOSER=false \ + USERNAME=codespace \ + bash /tmp/php-install.sh && \ + mv /tmp/00-restore-env.sh /etc/profile.d/00-restore-env.sh && \ + rm -rf /tmp/php-install.sh /var/lib/apt/lists/* + # Rename the upstream `codespace` user to `coder` so we preserve the # existing home directory and shell environment provided by the base image. RUN usermod -l coder codespace && \