Critical CVE in PHP: PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Start by reading the linked PHP security advisory and locate where this repository selects the PHP version for its Docker image. Check which PHP version LinkStack currently uses and whether it is affected by the listed CVEs. If affected, update to a patched release and confirm the image builds; if not, explain why LinkStack is unaffected in the issue.
Written by the indexing model from the issue text.
Description
A critical vulnerability has been discovered in PHP ([security advisory](https://www.php.net/archive/2026.php#2026-10-20-1)), and emergency security updates have been released (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35).
This vulnerability allows remote code execution (RCE).
Could you release a new version of LinkStack that upgrades PHP to a patched version?
If LinkStack is not affected by this vulnerability for any reason, please clarify why and close this issue.
- Dominant language
- Shell
- Stars
- 527
- Forks
- 72
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from LinkStackOrg/linkstack-docker
-
Potential information disclosure: runtime Laravel log accessible without authentication in a Docker deploymentPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 4/5 3-5 days Newbie friendliness 35/100
LinkStackOrg/linkstack-docker#168 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
LinkStackOrg/linkstack-docker#166 ·
-
Volume path overlap with existing paths inside imagePossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 4/5 1-2 days Newbie friendliness 52/100
LinkStackOrg/linkstack-docker#162 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 57/100
LinkStackOrg/linkstack-docker#161 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
LinkStackOrg/linkstack-docker#160 · 3 comments ·
All issues in LinkStackOrg/linkstack-docker
Similar issues
-
Python Volcengine provider returns failures instead of raising themPossibly taken @Ricardo-M-L claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
agent-infra/sandbox#248 ·
-
chore priority:low size:S
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
celo-org/celopedia-skills#98 ·
Maintainers usually reply within 1 day
-
Git for Windows shouldn't be locked on their `.windows.1` versionsPossibly taken A pull request linked to this issue is open or already merged. Opengit windows
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
jenkins-infra/packer-images#3179 ·
Maintainers usually reply within 1 day
-
ready-for-pr
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
kunchenguid/firstmate#7679 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
MISP/misp-docker#478 ·
Maintainers usually reply within 1 day