From f461d22aaedf78c301730a6af6f1ef3d638a8d3b Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Wed, 21 Oct 2026 07:21:47 -0700 Subject: [PATCH] fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed CVE-2026-109618 / CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp). Adds configs/zz-php2shell-mitigation.ini (fatal_error_backtraces=0, session.upload_progress.enabled=0, max_input_nesting_level=16) and installs it into each image's PHP scan dir as zz-php2shell-mitigation.ini so it sorts after 99-prod-overrides.ini and the entrypoint-written 99-* fragments: - Dockerfile / Dockerfile.fpm: COPY to /etc/php.d/ next to prod-php.ini. - Dockerfile.lsphp / Dockerfile.litespeed: COPY to /etc/lsws-templates/ and cp into the computed lsphp $SCAN_DIR in the existing overrides RUN. fatal_error_backtraces is unknown to (and silently ignored by) PHP < 8.5, so one file serves every version. Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 4 ++++ Dockerfile.fpm | 4 ++++ Dockerfile.litespeed | 5 +++++ Dockerfile.lsphp | 5 +++++ configs/zz-php2shell-mitigation.ini | 5 +++++ 5 files changed, 23 insertions(+) create mode 100644 configs/zz-php2shell-mitigation.ini diff --git a/Dockerfile b/Dockerfile index 1b10086..386d044 100644 --- a/Dockerfile +++ b/Dockerfile @@ -41,6 +41,10 @@ RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local # Copy configs and web files COPY ./configs/default-index.conf /etc/httpd/conf.d/ COPY ./configs/prod-php.ini /etc/php.ini +# php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after +# every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once +# all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. +COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini COPY ./configs/phpinfo.php /var/www/html/ COPY ./configs/mariadb.repo /etc/yum.repos.d/ COPY ./configs/index.php /var/www/html/ diff --git a/Dockerfile.fpm b/Dockerfile.fpm index 3500108..96a2e27 100644 --- a/Dockerfile.fpm +++ b/Dockerfile.fpm @@ -39,6 +39,10 @@ RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local # Copy configs (PHP only, no Apache configs) COPY ./configs/prod-php.ini /etc/php.ini +# php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after +# every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once +# all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. +COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini COPY ./configs/mariadb.repo /etc/yum.repos.d/ # Set up cron job for log rotation diff --git a/Dockerfile.litespeed b/Dockerfile.litespeed index 7282054..a08aea8 100644 --- a/Dockerfile.litespeed +++ b/Dockerfile.litespeed @@ -83,6 +83,10 @@ COPY ./scripts/entrypoint-litespeed.sh \ /scripts/ RUN chmod +x /scripts/* COPY ./configs/litespeed/ /etc/lsws-templates/ +## php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after +## every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once +## all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. +COPY ./configs/zz-php2shell-mitigation.ini /etc/lsws-templates/zz-php2shell-mitigation.ini ## Apply our production lsphp ini overrides. Ask lsphp for its scan dir ## directly (varies by PHP minor version: 8.3/8.4/8.5 each have their own @@ -92,6 +96,7 @@ RUN bash -c 'set -e; \ SCAN_DIR=$(/usr/local/lsws/lsphp${PHPVER}/bin/lsphp -i 2>/dev/null | awk -F"=> " "/^Scan this dir/ {print \$2; exit}"); \ mkdir -p "$SCAN_DIR"; \ cp /etc/lsws-templates/lsphp-overrides.ini "$SCAN_DIR/99-prod-overrides.ini"; \ + cp /etc/lsws-templates/zz-php2shell-mitigation.ini "$SCAN_DIR/zz-php2shell-mitigation.ini"; \ echo "wrote overrides to $SCAN_DIR"' ## Disable the OLS WebAdmin port for customer-facing containers. Bind admin diff --git a/Dockerfile.lsphp b/Dockerfile.lsphp index 47c178a..e05084d 100644 --- a/Dockerfile.lsphp +++ b/Dockerfile.lsphp @@ -201,10 +201,15 @@ RUN chmod +x /scripts/entrypoint-lsphp.sh /scripts/detect-memory-lsphp.sh /scrip ## Apply production lsphp ini overrides into lsphp's scan dir (path varies by ## PHP minor version; ask lsphp directly — same idiom as Dockerfile.litespeed). COPY ./configs/litespeed/lsphp-overrides.ini /etc/lsws-templates/lsphp-overrides.ini +## php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after +## every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once +## all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. +COPY ./configs/zz-php2shell-mitigation.ini /etc/lsws-templates/zz-php2shell-mitigation.ini RUN bash -c 'set -e; \ SCAN_DIR=$(/usr/local/lsws/lsphp${PHPVER}/bin/lsphp -i 2>/dev/null | awk -F"=> " "/^Scan this dir/ {print \$2; exit}"); \ mkdir -p "$SCAN_DIR"; \ cp /etc/lsws-templates/lsphp-overrides.ini "$SCAN_DIR/99-prod-overrides.ini"; \ + cp /etc/lsws-templates/zz-php2shell-mitigation.ini "$SCAN_DIR/zz-php2shell-mitigation.ini"; \ echo "wrote overrides to $SCAN_DIR"' ## Install the cac_path_parity extension into lsphp's own extension_dir and load diff --git a/configs/zz-php2shell-mitigation.ini b/configs/zz-php2shell-mitigation.ini new file mode 100644 index 0000000..f0fd820 --- /dev/null +++ b/configs/zz-php2shell-mitigation.ini @@ -0,0 +1,5 @@ +; php2shell mitigation (CVE-2026-109618 / CVE-2026-109619, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) +; Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. +fatal_error_backtraces = 0 +session.upload_progress.enabled = 0 +max_input_nesting_level = 16