Skip to content

v3.16.1 — PHP 8.4.27: the PHP2Shell fix

Choose a tag to compare

View all tags
@otatechie otatechie released this 21 Oct 20:12
· 16 commits to main since this release
v3.16.1
3681a39

The image now runs PHP 8.4.27. No app changes and no migrations.

PHP2Shell, fixed

PHP 8.4.27 fixes CVE-2026-109618 and CVE-2026-109619: two critical remote code execution flaws in how PHP reads multipart form uploads. They're reachable before SlipNote's own code runs, by anyone who can send an upload. The runtime image is now serversideup/php:8.4.27-fpm-nginx. The exact tag means the server pulls the patched image instead of reusing a cached 8.4 one.

The asset build stage uses node:22.23.4-alpine, today's Node.js security release. It's used only for the build.

After deploying

In Dokploy's terminal for the service, php -v should print PHP 8.4.27. The environment settings from v3.16.0 (TRUSTED_PROXIES, CLIENT_IP_HEADER) carry over unchanged.

Assets 2
Loading