Skip to content

chore: move back to alpine 3.22 and php 8.2 - #485

Merged
Kdecherf merged 2 commits into
masterfrom
chore/php82
Oct 24, 2026
Merged

Kdecherf merged 2 commits into
masterfrom
chore/php82

Conversation

@Kdecherf

@Kdecherf Kdecherf commented Oct 24, 2026 •

Copy link
Copy Markdown
Member

This change partially reverts #467 and #476 to rebuild a new image for wallabag 2.6.
This addresses the critical RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619.

Main changes:

  • PHP updated from 8.1.32 to 8.2.35
  • Alpine updated from 3.19 to 3.22

We target PHP 8.2 as we already support it in the test matrix, without needing to release a new version.
Alpine version 3.22 is still supported for six months.

Quick grype scan:

$ grype wallabag/wallabag:2.6.14 | grep -E 'CVE-2026-109618|CVE-2026-109619'
 ✔ Loaded image                                                                                      wallabag/wallabag:2.6.14
 ✔ Parsed image                                       sha256:43746639f5f8abb4949394b69445f468e92c1c9430ef0986913d54e0f7994ff3
[...]

php81                      8.1.32-r0                                      apk           CVE-2026-109618      Critical  11.6% (96th)  10.7   
php81                      8.1.32-r0                                      apk           CVE-2026-109619      High      6.0% (93rd)   4.8    
336 packages from EOL distro "alpine 3.19.8" - vulnerability data may be incomplete or outdated; consider upgrading to a supported version

With this PR:

$ grype wallabag/wallabag:2.6.14.1 | grep -E 'CVE-2026-109618|CVE-2026-109619'
 ✔ Loaded image                                                                                    wallabag/wallabag:2.6.14.1
 ✔ Parsed image                                       sha256:5a4ae8c690656d3cc978a4da32d26559e0eb95dc7e71384b6a17cece0cffc3a4

Closes wallabag/wallabag#9094
Closes #480

This change partially reverts #467 and #476 to rebuild a new image for
wallabag 2.6. This addresses the critical RCE vulnerabilities CVE-2026-109618
and CVE-2026-109619.

Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
@Kdecherf
Kdecherf merged commit d0a02cf into master Oct 24, 2026
4 checks passed
@Kdecherf
Kdecherf deleted the chore/php82 branch October 24, 2026 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] Potential exposure to PHP2Shell RCE vulnerability Update PHP to at least 8.2 and rebuild using todays (Oct 21) php images

1 participant