Repository navigation
docs(blog): add PHP2Shell post for DDEV users - #760
Merged
Merged
Conversation
|
🌐 Fork Preview for PR #760 https://pr-760.ddev-com-fork-previews.pages.dev This preview updates automatically when you push changes to your fork. |
stasadev
force-pushed
the
20261021_stasadev_php2shell
branch
from
October 21, 2026 16:01
434a692 to
2ff0651
Compare
## Short Summary (TL;DR) Adds a short post about the October 21 PHP fixes for CVE-2026-109618 and CVE-2026-109619: local DDEV projects aren't affected, hosting is where to update, and how to get the fixed PHP into DDEV projects before DDEV v1.25.5. ## How This PR Solves The Issue The post goes out before the release post, so people asking about PHP2Shell have an answer now. The workarounds were tried on DDEV v1.25.4 on AMD64 against that day's deb.sury.org packages: a rebuild without the cache reinstalls PHP 5.6 through 8.1, and a `.ddev/web-build/Dockerfile.php2shell` with `apt-get install --only-upgrade 'php*'` took PHP 8.3.33 to 8.3.36, with and without `use_hardened_images`. A full `apt-get upgrade` is avoided because it also upgrades `ca-certificates`, which breaks the start of hardened images. The post recommends `ddev restart --no-cache`, because Docker's build cache is shared between projects and reused an earlier build of the same `RUN` line in testing. For anyone who can't update yet, it shows the advisory's settings in `.ddev/php/php2shell.ini`, which DDEV adds to PHP-FPM's configuration. deb.sury.org has no ARM64 builds yet, so the post tells ARM64 users to wait. ## Manual Testing Instructions Open `https://pr-760.ddev-com-fork-previews.pages.dev/blog/php2shell-what-ddev-users-need-to-know/` and check the post, its TL;DR, and its banner in light and dark mode. ## Release/Deployment Notes Update the post when deb.sury.org publishes the ARM64 builds and when DDEV v1.25.5 is out. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
stasadev
force-pushed
the
20261021_stasadev_php2shell
branch
from
October 21, 2026 16:03
2ff0651 to
0f21f4b
Compare
…ell post `ddev php -v` already shows when PHP was built, which is simpler than querying the package version with `dpkg-query`. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ARM64 in the PHP2Shell post Readers may not know which architecture names apply to them, so the post says which processors and machines each one covers, including that Intel and AMD run most web servers. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Once a project is on DDEV v1.25.5, the line finds nothing to upgrade, and offline it still exits successfully, so the comment no longer suggests that removing the file is urgent. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
PR closed. The Cloudflare Pages preview is no longer updated. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Short Summary (TL;DR)
Adds a short post about the October 21 PHP fixes for CVE-2026-109618 and CVE-2026-109619: local DDEV projects aren't affected, hosting is where to update, and how to get the fixed PHP into DDEV projects before DDEV v1.25.5.
How This PR Solves The Issue
The post goes out before the release post, so people asking about PHP2Shell have an answer now. The workarounds were tried on DDEV v1.25.4 on AMD64 against that day's deb.sury.org packages: a rebuild without the cache reinstalls PHP 5.6 through 8.1, and a
.ddev/web-build/Dockerfile.php2shellwithapt-get install --only-upgrade 'php*'took PHP 8.3.33 to 8.3.36, with and withoutuse_hardened_images. A fullapt-get upgradeis avoided because it also upgradesca-certificates, which breaks the start of hardened images. The post recommendsddev restart --no-cacheorddev utility rebuild, because Docker's build cache is shared between projects and reused an earlier build of the sameRUNline in testing.For anyone who can't update yet, it shows the advisory's settings in
.ddev/php/php2shell.ini, which DDEV adds to PHP-FPM's configuration. deb.sury.org has no ARM64 builds yet, so the post tells ARM64 users to wait.Manual Testing Instructions
Open
https://pr-760.ddev-com-fork-previews.pages.dev/blog/php2shell-what-ddev-users-need-to-know/and check the post, its TL;DR, and its banner in light and dark mode.Release/Deployment Notes
Update the post when deb.sury.org publishes the ARM64 builds and when DDEV v1.25.5 is out.
🤖 Developed with assistance from Claude Code