fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed #26

2026-10-21T14:22:00Z

jknapp commented

2026-10-21 14:22:00 +00:00

Summary

Persistent INI mitigation for php2shell (CVE-2026-109618 / CVE-2026-109619, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) in every image that runs customer PHP.

New configs/zz-php2shell-mitigation.ini:

fatal_error_backtraces = 0
session.upload_progress.enabled = 0
max_input_nesting_level = 16

Installed as zz-php2shell-mitigation.ini so it sorts after 99-prod-overrides.ini and the entrypoint-written 99-* fragments.

Image	Mechanism
cac (`Dockerfile`)	`COPY` → `/etc/php.d/` next to `prod-php.ini`
cac-fpm (`Dockerfile.fpm`)	same
cac-lsphp (`Dockerfile.lsphp`)	`COPY` → `/etc/lsws-templates/`, `cp` into the computed lsphp `$SCAN_DIR` in the existing overrides `RUN`
cac-litespeed (`Dockerfile.litespeed`)	same

shared-httpd / shared-ols untouched: shared-ols strips the stock lsphp extProcessor/scriptHandler and runs no PHP (customer PHP runs in cac-lsphp sidecars).

fatal_error_backtraces is silently ignored on PHP < 8.5 (measured on 8.2.34/8.3.35), so one file serves all versions. No memory_limit / RLIMIT changes.

Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.

Verification

CI Shell-Checks reproduced locally: bash -n on all scripts OK, shellcheck clean set OK, lsphp-info-probe.test.sh 36 passed / 0 failed.
Full cac-fpm build could not run locally (Remi mirrors unreachable from the build host). Instead, the file was overlaid on the published cac-fpm:php83 (PHP 8.3.35) at /etc/php.d/zz-php2shell-mitigation.ini: both php -i and php-fpm -i report max_input_nesting_level => 16 and session.upload_progress.enabled => Off.

🤖 Generated with Claude Code

## Summary Persistent INI mitigation for **php2shell** (CVE-2026-109618 / CVE-2026-109619, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp) in every image that runs customer PHP. New `configs/zz-php2shell-mitigation.ini`: ``` fatal_error_backtraces = 0 session.upload_progress.enabled = 0 max_input_nesting_level = 16 ``` Installed as `zz-php2shell-mitigation.ini` so it sorts after `99-prod-overrides.ini` and the entrypoint-written `99-*` fragments. | Image | Mechanism | |---|---| | cac (`Dockerfile`) | `COPY` → `/etc/php.d/` next to `prod-php.ini` | | cac-fpm (`Dockerfile.fpm`) | same | | cac-lsphp (`Dockerfile.lsphp`) | `COPY` → `/etc/lsws-templates/`, `cp` into the computed lsphp `$SCAN_DIR` in the existing overrides `RUN` | | cac-litespeed (`Dockerfile.litespeed`) | same | shared-httpd / shared-ols untouched: shared-ols strips the stock lsphp extProcessor/scriptHandler and runs no PHP (customer PHP runs in cac-lsphp sidecars). `fatal_error_backtraces` is silently ignored on PHP < 8.5 (measured on 8.2.34/8.3.35), so one file serves all versions. No memory_limit / RLIMIT changes. Remove once all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. ## Verification - CI Shell-Checks reproduced locally: `bash -n` on all scripts OK, shellcheck clean set OK, `lsphp-info-probe.test.sh` 36 passed / 0 failed. - Full cac-fpm build could not run locally (Remi mirrors unreachable from the build host). Instead, the file was overlaid on the published `cac-fpm:php83` (PHP 8.3.35) at `/etc/php.d/zz-php2shell-mitigation.ini`: both `php -i` and `php-fpm -i` report `max_input_nesting_level => 16` and `session.upload_progress.enabled => Off`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-21 14:22:00 +00:00

fix(php): bake php2shell ini mitigation into cac/cac-fpm/cac-lsphp/cac-litespeed f461d22aae

CVE-2026-109618 / CVE-2026-109619 (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp).
Adds configs/zz-php2shell-mitigation.ini (fatal_error_backtraces=0,
session.upload_progress.enabled=0, max_input_nesting_level=16) and installs it
into each image's PHP scan dir as zz-php2shell-mitigation.ini so it sorts after
99-prod-overrides.ini and the entrypoint-written 99-* fragments:

- Dockerfile / Dockerfile.fpm: COPY to /etc/php.d/ next to prod-php.ini.
- Dockerfile.lsphp / Dockerfile.litespeed: COPY to /etc/lsws-templates/ and
  cp into the computed lsphp $SCAN_DIR in the existing overrides RUN.

fatal_error_backtraces is unknown to (and silently ignored by) PHP < 8.5, so
one file serves every version. Remove once all images ship
PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit 998eb17f39 into trunk

2026-10-21 14:22:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-apache-container#26