Skip to content

RD-API-Server v1.7.2 — PHP 8.5.12 security release

Latest
Latest

Choose a tag to compare

View all tags
@TheJakeBraun TheJakeBraun released this 21 Oct 19:09
· 2 commits to main since this release
v1.7.2
b47126a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release: PHP 8.5.12 (critical, update now)

The runtime image moves to the official PHP 8.5.12 (php:8.5.12-fpm-bookworm, digest-pinned), which fixes two critical, unauthenticated remote code execution vulnerabilities in PHP itself:

  • CVE-2026-109618: out-of-memory handling can leave request data half-initialized; request cleanup then treats it as valid.
  • CVE-2026-109619: request-owned state can outlive its memory and be used by the next request on the same PHP-FPM worker.

Every PHP-FPM installation serving web requests was affected. See the PHP security advisory.

Defense in depth from the advisory: fatal_error_backtraces = 0 in the runtime image, next to session.upload_progress.enabled = Off from v1.7.1.

Upgrade: pull ghcr.io/gigaionllc/rustdesk-api-server:1.7.2 (or :latest) and recreate the container. No database migrations and no configuration changes; the RustDesk client protocol is unchanged.

Assets 2
Loading