Skip to content

v1.0.9 — Urgent PHP security fix (CVE-2026-109618, CVE-2026-109619)

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 17:04
v1.0.9
bde447a

Urgent security release for CVE-2026-109618 and CVE-2026-109619.

Updates the NetKeep runtime to PHP 8.4.27 and pins the patched FrankenPHP and Composer images by digest. Build and CI checks reject vulnerable PHP versions.

  • Updates vulnerable PHP and JavaScript dependencies and makes dependency audits blocking.
  • Updates the test simulator cryptography dependency for CVE-2026-56854.
  • Preserves restore command compatibility with the updated Laravel types.
  • Publishes NetKeep and updater 1.0.9, and Oxidized revision 0.37.0-r6, for linux/amd64 and linux/arm64 on Docker Hub and GHCR.

Use the attached digest-pinned Compose file and signed update manifest to upgrade. Existing installations must recreate all PHP services with the corrected image; updating source files alone does not patch running containers.

Validation includes PHP tests, frontend checks, browser installation and navigation tests, external-service integration tests, backup/restore, dependency audits, and image scanning. The optional Cloudflare R2 integration requires a separately configured test environment.

Official advisory: https://www.php.net/archive/2026.php

Assets 6
Loading