Skip to content

fix(universal): patch PHP for CVE-2026-109618 and CVE-2026-109619 #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matifali merged 1 commit into from
Oct 25, 2026
Merged

fix(universal): patch PHP for CVE-2026-109618 and CVE-2026-109619 #343

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions images/universal/ubuntu.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,27 @@ RUN rm -R /opt/conda && \
# Install Chrome for AI Browser Testing
RUN yes | npx playwright install chrome

# Rebuild PHP from source to patch CVE-2026-109618 and CVE-2026-109619
# (PHP2Shell). The upstream universal image still pins PHP 8.5.0 and 8.4.15.
# This reuses the upstream PHP feature script (pinned to a commit) so the
# layout, configure flags, Xdebug, and the `current` symlink match the base
# image. Composer lives in /usr/local/bin and is left as is. Remove this step
# once the base image ships PHP 8.5.12 / 8.4.27 or newer.
ARG PHP_VERSION=8.5.12
ARG PHP_ADDITIONAL_VERSIONS=8.4.27
ARG PHP_FEATURE_COMMIT=94181c0188ce13b8c145ab114e887715d45bd982
RUN cp /etc/profile.d/00-restore-env.sh /tmp/00-restore-env.sh && \
rm -rf /usr/local/php/* && \
curl -fsSL -o /tmp/php-install.sh \
"https://raw.githubusercontent.com/devcontainers/features/${PHP_FEATURE_COMMIT}/src/php/install.sh" && \
VERSION="${PHP_VERSION}" \
ADDITIONALVERSIONS="${PHP_ADDITIONAL_VERSIONS}" \
INSTALLCOMPOSER=false \
USERNAME=codespace \
bash /tmp/php-install.sh && \
mv /tmp/00-restore-env.sh /etc/profile.d/00-restore-env.sh && \
rm -rf /tmp/php-install.sh /var/lib/apt/lists/*

# Rename the upstream `codespace` user to `coder` so we preserve the
# existing home directory and shell environment provided by the base image.
RUN usermod -l coder codespace && \
Expand Down
Loading