Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Heads up: this repo pins a PHP version affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

Offen
  • Stimmt etwas nicht?
#494 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
35/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
docker, php
Bereich
devops, security

Rechercherichtung

Start by inspecting the repository's Dockerfile and identify the PHP base image tag it uses. Check whether that version is affected by the advisories cited in the issue, then update to a patched release or document the vendor backport if the project must stay on an older version. Rebuild and verify the image uses the patched PHP version.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Hey, I ran a GitHub code search for Dockerfiles pinning an end-of-life PHP base image and your repo came up. You're getting this because of that.

What happened: On October 21 2026 the PHP project disclosed two critical unauthenticated remote-code-execution flaws in PHP core, together nicknamed "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). They affect every PHP build before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are end-of-life and get no official fix, only source backports for 7.4 / 8.0 / 8.1. The FBI and CISA have both urged operators to patch immediately or take affected systems offline.

Why this repo

Your repo has a Dockerfile building on a web-serving PHP image (php:…-apache or php:…-fpm) for a release below the patch line (7.2–8.1). Those tags get no official PHP fix, so the image serves web requests on a vulnerable PHP unless you upgrade or apply the backport. mod_php, the -apache image, is the configuration the advisory rates highest-risk.

Checklist
  1. Move the base image to a patched release: php:8.2.35, php:8.3.36, php:8.4.27 or php:8.5.12 (or newer).
  2. If you must stay on 7.4 / 8.0 / 8.1, apply the PHP security team's source backport, or get a patched package from your distro / LTS vendor.
  3. Rebuild and redeploy. A rebuild alone does not help if the tag is still below the patch line.
  4. If you can't patch right away, the FBI and CISA both say to take the system offline until it's fixed.
  5. Watch your web servers: a PHP worker process unexpectedly launching a shell or downloading files is the thing to look for.
  6. If you find signs of compromise, isolate the box, preserve your web-server and PHP logs, and report it to your local FBI field office or https://www.ic3.gov.
If you can't update immediately

These reduce exposure to specific attack paths. They are not a fix; only an update is.

  • Enforce memory_limit=-1 administratively (FPM pool or Apache config) so an application can't put a finite limit back.
  • Set session.upload_progress.enabled=0 and restart every worker.
  • On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
  • Keep post_max_size conservative and bound multipart part / header counts at your proxy.
References
Disclaimer

This is informational only and not professional security advice. I ran a search and wanted affected maintainers to hear about it. If this is a false positive, a library, an example, a test fixture, an archived project, or an image that already carries a distro backport, sorry for the noise, feel free to close.

Vorherrschende Sprache
PHP
Sterne
194
Forks
104
Ø Merge
20 Std. 28 Min.
Gemergte PRs (30 T.)
3

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus nextcloud/nextcloud-docker-dev

Alle Issues in nextcloud/nextcloud-docker-dev

Ähnliche Issues

Weitere Issues zu PHP

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.