fix(images): install Remi packages from the origin, not the lagging mirrors

During the php2shell release the Remi mirrors still served 8.2.34 hours after
8.2.35 was published, so cac/cac-fpm builds shipped vulnerable PHP. Enable the
repo files' baseurl (rpms.remirepo.net) and comment the mirrorlist. Verified on
the build server: a clean almalinux/10-base install now gets PHP 8.2.35.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -61,6 +61,9 @@ jobs:
   Build-and-Push:
     runs-on: ubuntu-latest
     strategy:
+      # One PHP version failing (e.g. an EOL stream) must not cancel the
+      # security builds of the others.
+      fail-fast: false
       matrix:
         phpver: [74, 80, 81, 82, 83, 84, 85]
     steps:
@@ -103,6 +106,9 @@ jobs:
   Build-FPM-Images:
     runs-on: ubuntu-latest
     strategy:
+      # One PHP version failing (e.g. an EOL stream) must not cancel the
+      # security builds of the others.
+      fail-fast: false
       matrix:
         phpver: [74, 80, 81, 82, 83, 84, 85]
     steps:
@@ -146,6 +152,9 @@ jobs:
   Build-LiteSpeed-Images:
     runs-on: ubuntu-latest
     strategy:
+      # One PHP version failing (e.g. an EOL stream) must not cancel the
+      # security builds of the others.
+      fail-fast: false
       matrix:
         # PHP 7.4/8.0 deliberately excluded — the LiteSpeed prebuilt base
         # images stop at older OLS releases for those PHP versions, and the
@@ -216,6 +225,9 @@ jobs:
   Build-LSPHP-Images:
     runs-on: ubuntu-latest
     strategy:
+      # One PHP version failing (e.g. an EOL stream) must not cancel the
+      # security builds of the others.
+      fail-fast: false
       matrix:
         # Same PHP matrix as cac-litespeed (81–85): cac-lsphp is the detached
         # backend for the shared-ols tier and shares the litespeed prebuilt

Dockerfile

@@ -9,6 +9,10 @@ ARG CACHE_BUST=
 RUN dnf install -y \
       https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
       https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
+    # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
+    # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
+    # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1).
+    sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
     dnf update -y && \
     dnf install -y httpd mod_ssl openssl wget procps cronie iproute postgresql-devel microdnf less git \
       nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix && \
@@ -41,6 +45,10 @@ RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local
 # Copy configs and web files
 COPY ./configs/default-index.conf /etc/httpd/conf.d/
 COPY ./configs/prod-php.ini /etc/php.ini
+# php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after
+# every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once
+# all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
+COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini
 COPY ./configs/phpinfo.php /var/www/html/
 COPY ./configs/mariadb.repo /etc/yum.repos.d/
 COPY ./configs/index.php /var/www/html/

Dockerfile.fpm

@@ -9,6 +9,10 @@ ARG CACHE_BUST=
 RUN dnf install -y \
       https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm \
       https://rpms.remirepo.net/enterprise/remi-release-10.rpm && \
+    # Use Remi's origin, not the mirrorlist: during the 2026-10-21 PHP security
+    # release the mirrors lagged hours behind (still 8.2.34 when 8.2.35 was out),
+    # so builds shipped unpatched PHP. Packages stay GPG-checked (gpgcheck=1).
+    sed -i -e 's/^#baseurl=/baseurl=/' -e 's/^mirrorlist=/#mirrorlist=/' /etc/yum.repos.d/remi*.repo && \
     dnf update -y && \
     dnf install -y openssl wget procps cronie iproute postgresql-devel microdnf less git \
       nano rsync unzip zip mariadb bind-utils jq patch nc tree dos2unix fcgi && \
@@ -39,6 +43,10 @@ RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local
 
 # Copy configs (PHP only, no Apache configs)
 COPY ./configs/prod-php.ini /etc/php.ini
+# php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after
+# every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once
+# all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
+COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini
 COPY ./configs/mariadb.repo /etc/yum.repos.d/
 
 # Set up cron job for log rotation

Dockerfile.litespeed

@@ -83,6 +83,10 @@ COPY ./scripts/entrypoint-litespeed.sh \
      /scripts/
 RUN chmod +x /scripts/*
 COPY ./configs/litespeed/ /etc/lsws-templates/
+## php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after
+## every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once
+## all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
+COPY ./configs/zz-php2shell-mitigation.ini /etc/lsws-templates/zz-php2shell-mitigation.ini
 
 ## Apply our production lsphp ini overrides. Ask lsphp for its scan dir
 ## directly (varies by PHP minor version: 8.3/8.4/8.5 each have their own
@@ -92,6 +96,7 @@ RUN bash -c 'set -e; \
     SCAN_DIR=$(/usr/local/lsws/lsphp${PHPVER}/bin/lsphp -i 2>/dev/null | awk -F"=> " "/^Scan this dir/ {print \$2; exit}"); \
     mkdir -p "$SCAN_DIR"; \
     cp /etc/lsws-templates/lsphp-overrides.ini "$SCAN_DIR/99-prod-overrides.ini"; \
+    cp /etc/lsws-templates/zz-php2shell-mitigation.ini "$SCAN_DIR/zz-php2shell-mitigation.ini"; \
     echo "wrote overrides to $SCAN_DIR"'
 
 ## Disable the OLS WebAdmin port for customer-facing containers. Bind admin

Dockerfile.lsphp

@@ -201,10 +201,15 @@ RUN chmod +x /scripts/entrypoint-lsphp.sh /scripts/detect-memory-lsphp.sh /scrip
 ## Apply production lsphp ini overrides into lsphp's scan dir (path varies by
 ## PHP minor version; ask lsphp directly — same idiom as Dockerfile.litespeed).
 COPY ./configs/litespeed/lsphp-overrides.ini /etc/lsws-templates/lsphp-overrides.ini
+## php2shell mitigation (CVE-2026-109618/-109619). Named zz- so it sorts after
+## every other scan-dir ini (incl. runtime-written 99-*) and wins. Remove once
+## all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
+COPY ./configs/zz-php2shell-mitigation.ini /etc/lsws-templates/zz-php2shell-mitigation.ini
 RUN bash -c 'set -e; \
     SCAN_DIR=$(/usr/local/lsws/lsphp${PHPVER}/bin/lsphp -i 2>/dev/null | awk -F"=> " "/^Scan this dir/ {print \$2; exit}"); \
     mkdir -p "$SCAN_DIR"; \
     cp /etc/lsws-templates/lsphp-overrides.ini "$SCAN_DIR/99-prod-overrides.ini"; \
+    cp /etc/lsws-templates/zz-php2shell-mitigation.ini "$SCAN_DIR/zz-php2shell-mitigation.ini"; \
     echo "wrote overrides to $SCAN_DIR"'
 
 ## Install the cac_path_parity extension into lsphp's own extension_dir and load

configs/zz-php2shell-mitigation.ini

@@ -0,0 +1,5 @@
+; php2shell mitigation (CVE-2026-109618 / CVE-2026-109619, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp)
+; Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
+fatal_error_backtraces = 0
+session.upload_progress.enabled = 0
+max_input_nesting_level = 16

scripts/lsphp-apt-upgrade.sh

@@ -49,11 +49,16 @@ echo "lsphp-apt-upgrade: base image lsphp${PHPVER}=$(dpkg-query -W -f='${Version
 
 # The candidate for lsphpNN must come from the LiteSpeed repo — not "none", and
 # not merely whatever is already installed.
-if ! apt-cache madison "lsphp${PHPVER}" | grep -q 'rpms.litespeedtech.com'; then
+# Read each output into a variable and match in the shell: piping into an
+# early-exit reader (grep -q, awk ... exit) under pipefail can SIGPIPE the writer
+# and report "missing" for a package that is there (scripts/tests/lsphp-info-probe.test.sh).
+MADISON=$(apt-cache madison "lsphp${PHPVER}")
+if [[ "$MADISON" != *rpms.litespeedtech.com* ]]; then
     apt-cache policy "lsphp${PHPVER}" >&2 || true
     die "the LiteSpeed apt repo does not offer lsphp${PHPVER} (repo missing from sources, or its index is empty)."
 fi
-CAND=$(apt-cache policy "lsphp${PHPVER}" | awk '/Candidate:/ {print $2; exit}')
+POLICY=$(apt-cache policy "lsphp${PHPVER}")
+CAND=$(awk '/Candidate:/ {print $2; exit}' <<<"$POLICY")
 echo "lsphp-apt-upgrade: repo candidate lsphp${PHPVER}=${CAND}"
 
 if [ "$OS_UPGRADE" = 1 ]; then