Require patched PHP and disable session upload progress

Dockerfile

@@ -58,6 +58,7 @@ RUN set -ex \
       tzdata \
  && ln -sf /usr/bin/php84 /usr/bin/php \
  && ln -sf /usr/sbin/php-fpm84 /usr/sbin/php-fpm \
+ && php -r 'if (PHP_VERSION_ID < 80427) { fwrite(STDERR, "PHP 8.4.27 or newer is required for the October 2026 security fixes.\n"); exit(1); }' \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log

root/etc/php84/conf.d/99-security.ini

@@ -0,0 +1,4 @@
+; PHP advisory, 2026-10-23: keep disabled until the follow-up fix lands.
+; https://www.php.net/archive/2026.php#2026-10-23-1
+; This is defense in depth and does not replace a patched PHP runtime.
+session.upload_progress.enabled = 0

tests/test_login.py

@@ -2,6 +2,7 @@
 import re
 import requests
 import os
+import subprocess
 
 from requests.exceptions import ConnectionError
 
@@ -84,3 +85,12 @@ def test_logging_in(wallabag_service):
     assert '/starred/list' in r.text
     assert '/archive/list' in r.text
     assert '/all/list' in r.text
+
+
+def test_php_security_baseline(wallabag_service, database):
+    subprocess.run([
+        "docker", "compose", "-p", "wallabag_{}".format(database),
+        "-f", "tests/docker-compose.{}.yml".format(database),
+        "exec", "-T", "wallabag", "php", "-r",
+        'exit(PHP_VERSION_ID >= 80427 && !filter_var(ini_get("session.upload_progress.enabled"), FILTER_VALIDATE_BOOLEAN) ? 0 : 1);',
+    ], check=True)