From 081bf4e852dbdd8f61371bf5e9c16f77e96ec36e Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Mon, 26 Oct 2026 22:39:45 +0000 Subject: [PATCH 1/2] Security: Upgrade Brotli past CVE-2026-111497 The official PHP images still ship vulnerable libbrotli builds, which PHP's curl extension links against. List libbrotli1 (Debian) and brotli-libs (Alpine) in every variation so the build upgrades them to the patched distribution packages. Remove them once the official images ship the fix. The Alpine install helper now runs `apk add --upgrade`, so an already-installed package is upgraded the same way `apt-get install` does on Debian. --- .../usr/local/bin/docker-php-serversideup-dep-install-alpine | 2 +- src/variations/cli/Dockerfile | 3 +++ src/variations/fpm-apache/Dockerfile | 3 +++ src/variations/fpm-nginx/Dockerfile | 3 +++ src/variations/fpm/Dockerfile | 3 +++ src/variations/frankenphp/Dockerfile | 3 +++ 6 files changed, 16 insertions(+), 1 deletion(-) diff --git a/src/common/usr/local/bin/docker-php-serversideup-dep-install-alpine b/src/common/usr/local/bin/docker-php-serversideup-dep-install-alpine index b9644df6..620cb91b 100644 --- a/src/common/usr/local/bin/docker-php-serversideup-dep-install-alpine +++ b/src/common/usr/local/bin/docker-php-serversideup-dep-install-alpine @@ -60,7 +60,7 @@ fi DEP_PACKAGES="$*" echo "🤖 Installing: $DEP_PACKAGES" apk update -apk add --no-cache "$@" +apk add --no-cache --upgrade "$@" echo "🧼 Cleaning up installation of: $DEP_PACKAGES" diff --git a/src/variations/cli/Dockerfile b/src/variations/cli/Dockerfile index 70c47a7c..afbed7ec 100644 --- a/src/variations/cli/Dockerfile +++ b/src/variations/cli/Dockerfile @@ -7,9 +7,12 @@ ARG PHP_VARIATION='cli' ########## FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION} +# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix. ARG DEPENDENCY_PACKAGES_ALPINE="\ + brotli-libs \ shadow" ARG DEPENDENCY_PACKAGES_DEBIAN="\ + libbrotli1 \ procps \ zip" ARG DEPENDENCY_PHP_EXTENSIONS='opcache pcntl pdo_mysql pdo_pgsql redis zip' diff --git a/src/variations/fpm-apache/Dockerfile b/src/variations/fpm-apache/Dockerfile index 1978e983..d6783957 100644 --- a/src/variations/fpm-apache/Dockerfile +++ b/src/variations/fpm-apache/Dockerfile @@ -22,12 +22,15 @@ RUN docker-php-serversideup-s6-install # FPM-APACHE: Main Image ########## FROM ${BASE_IMAGE} +# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix. ARG DEPENDENCY_PACKAGES_ALPINE="\ + brotli-libs \ apache2 \ fcgi \ shadow" ARG DEPENDENCY_PACKAGES_DEBIAN="\ apache2 \ + libbrotli1 \ libfcgi-bin \ procps \ zip" diff --git a/src/variations/fpm-nginx/Dockerfile b/src/variations/fpm-nginx/Dockerfile index a37e7569..70021770 100644 --- a/src/variations/fpm-nginx/Dockerfile +++ b/src/variations/fpm-nginx/Dockerfile @@ -97,12 +97,15 @@ RUN \ # FPM-NGINX: Main Image ########## FROM ${BASE_IMAGE} +# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix. ARG DEPENDENCY_PACKAGES_ALPINE="\ + brotli-libs \ fcgi \ gettext \ shadow" ARG DEPENDENCY_PACKAGES_DEBIAN="\ gettext-base \ + libbrotli1 \ libfcgi-bin \ procps \ zip" diff --git a/src/variations/fpm/Dockerfile b/src/variations/fpm/Dockerfile index 720b8662..19103f06 100644 --- a/src/variations/fpm/Dockerfile +++ b/src/variations/fpm/Dockerfile @@ -7,10 +7,13 @@ ARG PHP_VARIATION='fpm' ########## FROM php:${PHP_VERSION}-${PHP_VARIATION}-${BASE_OS_VERSION} +# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix. ARG DEPENDENCY_PACKAGES_ALPINE="\ + brotli-libs \ fcgi \ shadow" ARG DEPENDENCY_PACKAGES_DEBIAN="\ + libbrotli1 \ libfcgi-bin \ procps \ zip" diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index 799d1c71..afaaf6aa 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -145,10 +145,13 @@ RUN if cat /etc/os-release | grep -q 'debian'; then \ # FrankenPHP Final #################### FROM common AS final +# brotli-libs and libbrotli1 upgrade past CVE-2026-111497. Remove them once the official PHP images ship the fix. ARG DEPENDENCY_PACKAGES_ALPINE="\ + brotli-libs \ libstdc++ \ shadow" ARG DEPENDENCY_PACKAGES_DEBIAN="\ + libbrotli1 \ libstdc++6 \ procps \ zip" From 881fc15ca63732dd02143d11512b81d19252537e Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Mon, 26 Oct 2026 22:40:01 +0000 Subject: [PATCH 2/2] Security: Upgrade FrankenPHP to v1.13.4 FrankenPHP 1.13.4 fixes seven vulnerabilities, including a crash in worker mode that 1.13.2 introduced. Its cbrotli dependency needs libbrotli 1.1 or newer, which Bookworm doesn't ship, so Bookworm images now build Brotli 1.2.1 from source and load it ahead of the distribution library. --- src/variations/frankenphp/Dockerfile | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index afaaf6aa..b4d60ba1 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -2,7 +2,7 @@ ARG BASE_OS_VERSION='trixie' ARG PHP_VERSION='8.5' ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}" -ARG FRANKENPHP_VERSION='1.13.2' +ARG FRANKENPHP_VERSION='1.13.4' ARG GOLANG_VERSION='1.27' ######################## @@ -98,6 +98,23 @@ ENV GOTOOLCHAIN="local" RUN docker-php-serversideup-dep-install-alpine "$PHPIZE_DEPS ${BUILD_DEPENDENCY_PACKAGES_ALPINE}" && \ docker-php-serversideup-dep-install-debian "${BUILD_DEPENDENCY_PACKAGES_DEBIAN}" +# Bookworm ships libbrotli 1.0.9, but FrankenPHP's cbrotli needs 1.1 or newer and +# 1.2.1 fixes CVE-2026-111497. Remove this once Bookworm is no longer supported. +# Multiarch library paths sort before libc.conf on arm64, so without 000-brotli.conf +# the distro libbrotli would still be loaded there. +WORKDIR /usr/local/src/brotli +RUN if ! pkg-config --atleast-version=1.1 libbrotlienc; then \ + docker-php-serversideup-download https://github.com/google/brotli/archive/refs/tags/v1.2.1.tar.gz /tmp/brotli.tar.gz && \ + echo "98d35d11a78dc453aebb7d10c3748f3f73ff78c8267c0dc697b8631f67bf7e8f /tmp/brotli.tar.gz" | sha256sum -c - && \ + tar xz --strip-components 1 -f /tmp/brotli.tar.gz && \ + rm -f /tmp/brotli.tar.gz && \ + cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF && \ + cmake --build build && \ + cmake --install build && \ + echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf && \ + ldconfig; \ + fi + # Install e-dant/watcher (necessary for file watching) WORKDIR /usr/local/src/watcher RUN WATCHER_TARBALL_URL=$(docker-php-serversideup-download https://api.github.com/repos/e-dant/watcher/releases/latest | \ @@ -242,7 +259,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \ COPY --from=composer:2 /usr/bin/composer /usr/bin/composer COPY --from=frankenphp-build /usr/local/bin/frankenphp /usr/local/bin/frankenphp -COPY --from=frankenphp-build /usr/local/lib/libwatcher* /usr/local/lib/ +COPY --from=frankenphp-build /usr/local/lib/libwatcher* /usr/local/lib/libbrotli* /usr/local/lib/ COPY src/variations/frankenphp/etc/frankenphp/ /etc/frankenphp/ @@ -253,6 +270,9 @@ RUN \ if cat /etc/os-release | grep -q 'alpine'; then \ ldconfig /usr/local/lib; \ elif cat /etc/os-release | grep -q 'debian'; then \ + if [ -e /usr/local/lib/libbrotlicommon.so.1 ]; then \ + echo /usr/local/lib > /etc/ld.so.conf.d/000-brotli.conf; \ + fi; \ ldconfig; \ else \ echo "Unsupported OS"; \