From 0f21f4ba22435359d67eac552c8dffe6938e9f5e Mon Sep 17 00:00:00 2001 From: Stanislav Zhuk Date: Wed, 21 Oct 2026 18:30:17 +0300 Subject: [PATCH 1/4] docs(blog): add PHP2Shell post for DDEV users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Short Summary (TL;DR) Adds a short post about the October 21 PHP fixes for CVE-2026-109618 and CVE-2026-109619: local DDEV projects aren't affected, hosting is where to update, and how to get the fixed PHP into DDEV projects before DDEV v1.25.5. ## How This PR Solves The Issue The post goes out before the release post, so people asking about PHP2Shell have an answer now. The workarounds were tried on DDEV v1.25.4 on AMD64 against that day's deb.sury.org packages: a rebuild without the cache reinstalls PHP 5.6 through 8.1, and a `.ddev/web-build/Dockerfile.php2shell` with `apt-get install --only-upgrade 'php*'` took PHP 8.3.33 to 8.3.36, with and without `use_hardened_images`. A full `apt-get upgrade` is avoided because it also upgrades `ca-certificates`, which breaks the start of hardened images. The post recommends `ddev restart --no-cache`, because Docker's build cache is shared between projects and reused an earlier build of the same `RUN` line in testing. For anyone who can't update yet, it shows the advisory's settings in `.ddev/php/php2shell.ini`, which DDEV adds to PHP-FPM's configuration. deb.sury.org has no ARM64 builds yet, so the post tells ARM64 users to wait. ## Manual Testing Instructions Open `https://pr-760.ddev-com-fork-previews.pages.dev/blog/php2shell-what-ddev-users-need-to-know/` and check the post, its TL;DR, and its banner in light and dark mode. ## Release/Deployment Notes Update the post when deb.sury.org publishes the ARM64 builds and when DDEV v1.25.5 is out. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 --- .../blog/2026/10/banner-php2shell-dark.svg | 33 ++++++++ public/img/blog/2026/10/banner-php2shell.svg | 33 ++++++++ .../php2shell-what-ddev-users-need-to-know.md | 84 +++++++++++++++++++ 3 files changed, 150 insertions(+) create mode 100644 public/img/blog/2026/10/banner-php2shell-dark.svg create mode 100644 public/img/blog/2026/10/banner-php2shell.svg create mode 100644 src/content/blog/php2shell-what-ddev-users-need-to-know.md diff --git a/public/img/blog/2026/10/banner-php2shell-dark.svg b/public/img/blog/2026/10/banner-php2shell-dark.svg new file mode 100644 index 00000000..3d7c5a48 --- /dev/null +++ b/public/img/blog/2026/10/banner-php2shell-dark.svg @@ -0,0 +1,33 @@ + + + + + + PHP2Shell: What to Know + diff --git a/public/img/blog/2026/10/banner-php2shell.svg b/public/img/blog/2026/10/banner-php2shell.svg new file mode 100644 index 00000000..b0017a57 --- /dev/null +++ b/public/img/blog/2026/10/banner-php2shell.svg @@ -0,0 +1,33 @@ + + + + + + PHP2Shell: What to Know + diff --git a/src/content/blog/php2shell-what-ddev-users-need-to-know.md b/src/content/blog/php2shell-what-ddev-users-need-to-know.md new file mode 100644 index 00000000..dcc2aa88 --- /dev/null +++ b/src/content/blog/php2shell-what-ddev-users-need-to-know.md @@ -0,0 +1,84 @@ +--- +title: "PHP2Shell: What DDEV Users Need to Know" +pubDate: 2026-10-21 +summary: PHP fixed two critical vulnerabilities on October 21, 2026. Your local DDEV projects can't be reached from the internet, but your production servers can. Here's how to get the fixed PHP into your DDEV projects now, before DDEV v1.25.5. +author: Stas Zhuk +featureImage: + src: /img/blog/2026/10/banner-php2shell.svg + srcDark: /img/blog/2026/10/banner-php2shell-dark.svg + alt: "PHP2Shell: What to Know" +categories: + - Community +--- + +PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. They fix CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell", two vulnerabilities that can let a single unauthenticated request run code on a server. According to PHP's [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5), every PHP installation that serves web requests is at risk. + +**TL;DR:** + +- If you use DDEV only for local development, your DDEV projects aren't affected. +- Update PHP on the servers where your sites are hosted. +- If you use DDEV for casual hosting or `ddev share`, get the fixed PHP into those projects now, as described below, or upgrade to DDEV v1.25.5, which we hope to release on October 22. + +## What It Means for Your DDEV Projects + +Local development isn't affected because a DDEV project listens only on your own computer, so nobody on the internet can send it a request. A project is exposed in two cases: + +- [Casual hosting](https://docs.ddev.com/en/stable/users/topics/hosting/) runs a public site with DDEV. An attack would run code in the project's web container rather than on the host, but that container can still change the site's files and reach its database. +- [`ddev share`](https://docs.ddev.com/en/stable/users/usage/commands/#share) puts a project on a public URL. Don't share a project until it has the fixed PHP. + +:::warning[Update PHP where your sites are hosted] +Your production servers are exposed to the internet, so update PHP there first; distributions and LTS vendors got the patches in advance. PHP 8.1 and older get no updates from the PHP project, so check with your vendor or upgrade. If you can't update right away, see [Reducing Exposure](#reducing-exposure-until-you-can-update) below. +::: + +## Getting the Fixed PHP Into DDEV Before v1.25.5 + +DDEV gets PHP from [deb.sury.org](https://deb.sury.org/). When we checked around 16:00 UTC on October 21, it had fixed packages for PHP 5.6 through 8.5 for AMD64, which covers most Linux and Windows computers and Intel Macs. The ARM64 builds, for Apple Silicon, [come later](https://codeberg.org/oerdnj/deb.sury.org/issues/145), and v1.25.5 waits for them. + +On AMD64, you don't have to wait for v1.25.5: + +- **PHP 5.6 through 8.1** aren't in the `ddev-webserver` image. DDEV installs them when it builds the project's web image, so a rebuild installs the fixed packages. The version number doesn't change for these old versions, so check that the package build date is `20261021` or later: + + ```bash + ddev restart --no-cache # or: ddev utility rebuild + ddev exec 'dpkg-query -W php$DDEV_PHP_VERSION-fpm' + ``` + +- **PHP 8.2 through 8.5** are in the image. Create this file in the project, rebuild, and check that `ddev php -v` shows 8.5.12, 8.4.27, 8.3.36, or 8.2.35: + + ```dockerfile + # .ddev/web-build/Dockerfile.php2shell + # Delete this file after upgrading to DDEV v1.25.5 + RUN (apt-get update || true) && apt-get install -y --only-upgrade 'php*' + ``` + + ```bash + ddev restart --no-cache # or: ddev utility rebuild + ddev php -v + ``` + +We tested both cases on DDEV v1.25.4 on AMD64, with and without `use_hardened_images`. On ARM64, wait for deb.sury.org's ARM64 builds or for v1.25.5. + +## Reducing Exposure Until You Can Update + +PHP's advisory lists settings that block the attack paths it knows about. They don't make an installation safe, and a low `post_max_size` can break large uploads, so update as soon as you can. In a DDEV project, put them in a file and run `ddev restart`: + +```ini +; .ddev/php/php2shell.ini +; Delete this file once PHP is updated +session.upload_progress.enabled = 0 +; Use 32M if the site takes file uploads +post_max_size = 8M +upload_max_filesize = 6M +``` + +On PHP 8.5, also add `fatal_error_backtraces = 0`. DDEV adds `.ddev/php` files to PHP-FPM's configuration, so they apply before PHP parses a request, as the advisory requires. On other servers, the same lines go in `php.ini` or PHP's `conf.d` directory, followed by a restart of every PHP worker. The [advisory](https://www.php.net/archive/2026.php#2026-10-21-5) has the full list. + +## Thanks, Ondřej + +[Ondřej Surý](https://codeberg.org/oerdnj), who maintains the PHP packages for Debian and Ubuntu that DDEV and much of the PHP world use, published fixed AMD64 packages for every version back to PHP 5.6 on the day PHP released the fixes, with ARM64 builds to follow. If your work depends on those packages, consider [sponsoring him](https://github.com/sponsors/oerdnj). + +We'll update this post when DDEV v1.25.5 is out. If you have questions, reach out in any of the [support channels](https://docs.ddev.com/en/stable/users/support/). + +--- + +_This article was edited and refined with assistance from Claude Code._ From 87b5c016c329df9181405c09da50e1d7c757227e Mon Sep 17 00:00:00 2001 From: Stanislav Zhuk Date: Wed, 21 Oct 2026 19:09:32 +0300 Subject: [PATCH 2/4] docs(blog): check the PHP build date with `ddev php -v` in the PHP2Shell post MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `ddev php -v` already shows when PHP was built, which is simpler than querying the package version with `dpkg-query`. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 --- src/content/blog/php2shell-what-ddev-users-need-to-know.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/blog/php2shell-what-ddev-users-need-to-know.md b/src/content/blog/php2shell-what-ddev-users-need-to-know.md index dcc2aa88..0150b7fd 100644 --- a/src/content/blog/php2shell-what-ddev-users-need-to-know.md +++ b/src/content/blog/php2shell-what-ddev-users-need-to-know.md @@ -36,11 +36,11 @@ DDEV gets PHP from [deb.sury.org](https://deb.sury.org/). When we checked around On AMD64, you don't have to wait for v1.25.5: -- **PHP 5.6 through 8.1** aren't in the `ddev-webserver` image. DDEV installs them when it builds the project's web image, so a rebuild installs the fixed packages. The version number doesn't change for these old versions, so check that the package build date is `20261021` or later: +- **PHP 5.6 through 8.1** aren't in the `ddev-webserver` image. DDEV installs them when it builds the project's web image, so a rebuild installs the fixed packages. The version number doesn't change for these old versions, so check that `ddev php -v` shows `built: Oct 21 2026` or later: ```bash ddev restart --no-cache # or: ddev utility rebuild - ddev exec 'dpkg-query -W php$DDEV_PHP_VERSION-fpm' + ddev php -v ``` - **PHP 8.2 through 8.5** are in the image. Create this file in the project, rebuild, and check that `ddev php -v` shows 8.5.12, 8.4.27, 8.3.36, or 8.2.35: From 069ef323441c506659879578357e1019691ae2ec Mon Sep 17 00:00:00 2001 From: Stanislav Zhuk Date: Wed, 21 Oct 2026 19:15:12 +0300 Subject: [PATCH 3/4] docs(blog): name Intel, AMD, and ARM processors instead of AMD64 and ARM64 in the PHP2Shell post MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Readers may not know which architecture names apply to them, so the post says which processors and machines each one covers, including that Intel and AMD run most web servers. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 --- .../blog/php2shell-what-ddev-users-need-to-know.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/content/blog/php2shell-what-ddev-users-need-to-know.md b/src/content/blog/php2shell-what-ddev-users-need-to-know.md index 0150b7fd..e0a89be0 100644 --- a/src/content/blog/php2shell-what-ddev-users-need-to-know.md +++ b/src/content/blog/php2shell-what-ddev-users-need-to-know.md @@ -32,9 +32,9 @@ Your production servers are exposed to the internet, so update PHP there first; ## Getting the Fixed PHP Into DDEV Before v1.25.5 -DDEV gets PHP from [deb.sury.org](https://deb.sury.org/). When we checked around 16:00 UTC on October 21, it had fixed packages for PHP 5.6 through 8.5 for AMD64, which covers most Linux and Windows computers and Intel Macs. The ARM64 builds, for Apple Silicon, [come later](https://codeberg.org/oerdnj/deb.sury.org/issues/145), and v1.25.5 waits for them. +DDEV gets PHP from [deb.sury.org](https://deb.sury.org/). When we checked around 16:00 UTC on October 21, it had fixed packages for PHP 5.6 through 8.5 for Intel and AMD processors (AMD64), which run the vast majority of the world's web servers, most Windows and Linux computers, and Intel Macs. The builds for ARM processors (ARM64), such as Apple Silicon Macs (M1 and later), [come later](https://codeberg.org/oerdnj/deb.sury.org/issues/145), and v1.25.5 waits for them. -On AMD64, you don't have to wait for v1.25.5: +On Intel and AMD computers, you don't have to wait for v1.25.5: - **PHP 5.6 through 8.1** aren't in the `ddev-webserver` image. DDEV installs them when it builds the project's web image, so a rebuild installs the fixed packages. The version number doesn't change for these old versions, so check that `ddev php -v` shows `built: Oct 21 2026` or later: @@ -56,7 +56,7 @@ On AMD64, you don't have to wait for v1.25.5: ddev php -v ``` -We tested both cases on DDEV v1.25.4 on AMD64, with and without `use_hardened_images`. On ARM64, wait for deb.sury.org's ARM64 builds or for v1.25.5. +We tested both cases on DDEV v1.25.4 on an Intel computer, with and without `use_hardened_images`. On Apple Silicon Macs (M1 and later) and other ARM computers, wait for deb.sury.org's ARM64 builds or for v1.25.5. ## Reducing Exposure Until You Can Update @@ -75,7 +75,7 @@ On PHP 8.5, also add `fatal_error_backtraces = 0`. DDEV adds `.ddev/php` files t ## Thanks, Ondřej -[Ondřej Surý](https://codeberg.org/oerdnj), who maintains the PHP packages for Debian and Ubuntu that DDEV and much of the PHP world use, published fixed AMD64 packages for every version back to PHP 5.6 on the day PHP released the fixes, with ARM64 builds to follow. If your work depends on those packages, consider [sponsoring him](https://github.com/sponsors/oerdnj). +[Ondřej Surý](https://codeberg.org/oerdnj), who maintains the PHP packages for Debian and Ubuntu that DDEV and much of the PHP world use, published fixed packages for Intel and AMD processors for every version back to PHP 5.6 on the day PHP released the fixes, with ARM builds to follow. If your work depends on those packages, consider [sponsoring him](https://github.com/sponsors/oerdnj). We'll update this post when DDEV v1.25.5 is out. If you have questions, reach out in any of the [support channels](https://docs.ddev.com/en/stable/users/support/). From c881e2e5dbef07e2a4a0c3f2930ae9fb1cc5d273 Mon Sep 17 00:00:00 2001 From: Stanislav Zhuk Date: Wed, 21 Oct 2026 19:16:31 +0300 Subject: [PATCH 4/4] docs(blog): say that the PHP2Shell Dockerfile is safe to keep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Once a project is on DDEV v1.25.5, the line finds nothing to upgrade, and offline it still exits successfully, so the comment no longer suggests that removing the file is urgent. 🤖 Developed with assistance from [Claude Code](https://claude.ai/code) Co-Authored-By: Claude Opus 5.5 --- src/content/blog/php2shell-what-ddev-users-need-to-know.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/blog/php2shell-what-ddev-users-need-to-know.md b/src/content/blog/php2shell-what-ddev-users-need-to-know.md index e0a89be0..4b6f7598 100644 --- a/src/content/blog/php2shell-what-ddev-users-need-to-know.md +++ b/src/content/blog/php2shell-what-ddev-users-need-to-know.md @@ -47,7 +47,7 @@ On Intel and AMD computers, you don't have to wait for v1.25.5: ```dockerfile # .ddev/web-build/Dockerfile.php2shell - # Delete this file after upgrading to DDEV v1.25.5 + # Safe to keep; you can delete it after upgrading to DDEV v1.25.5 RUN (apt-get update || true) && apt-get install -y --only-upgrade 'php*' ```