From 8146b5ebc09110acc985fcfe0fd881fabfede86a Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Fri, 23 Oct 2026 12:30:17 +0000 Subject: [PATCH 1/2] Disable session upload progress by default Add PHP_SESSION_UPLOAD_PROGRESS_ENABLED and default it to 0, following PHP's October 23 advisory for CVE-2026-115560. --- .../docs/8.reference/1.environment-variable-specification.md | 1 + src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini | 2 +- src/variations/cli/Dockerfile | 1 + src/variations/fpm-apache/Dockerfile | 1 + src/variations/fpm-nginx/Dockerfile | 1 + src/variations/fpm/Dockerfile | 1 + src/variations/frankenphp/Dockerfile | 1 + 7 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/content/docs/8.reference/1.environment-variable-specification.md b/docs/content/docs/8.reference/1.environment-variable-specification.md index a9ea3fd6..08eea1ec 100644 --- a/docs/content/docs/8.reference/1.environment-variable-specification.md +++ b/docs/content/docs/8.reference/1.environment-variable-specification.md @@ -128,6 +128,7 @@ Setting environment variables all depends on what method you're using to run you `PHP_REALPATH_CACHE_TTL`
*Default: "600"*|The duration of time, in seconds for which to cache realpath information for a given file or directory. `600` is the value Symfony's performance guide recommends for applications that open many PHP files. (Symfony docs) (Official docs)|all `PHP_SESSION_COOKIE_HTTPONLY`
*Default: "On"*|Add the `HttpOnly` flag to the session cookie so browser scripts cannot read it. On by default as recommended by PHP. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (Official docs)|all `PHP_SESSION_COOKIE_SECURE`
*Default: "false"*|Specifies whether the session cookie should only be sent over HTTPS. Off by default so local development over HTTP works. Set to `true` in production when serving over HTTPS. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (Official docs)|all +`PHP_SESSION_UPLOAD_PROGRESS_ENABLED`
*Default: "0"*|Track file upload progress in `$_SESSION`. Off by default following PHP's October 23, 2026 security advisory. Set to `1` only if your app reads upload progress from the session and never changes `session.serialize_handler` at runtime. Only applies to native PHP sessions. (Official docs)|all `PHP_UPLOAD_MAX_FILE_SIZE`
*Default: "100M"*|The maximum size of an uploaded file. (Official docs)|all `PHP_ZEND_DETECT_UNICODE`
*Default: ""*|Check for BOM (Byte Order Mark) and see if the file contains valid multibyte characters. This detection is performed before processing of __halt_compiler(). Available only in Zend Multibyte mode. (Official docs)|all `PHP_ZEND_MULTIBYTE`
*Default: "Off"*|Enable or disable Zend Multibyte. (Official docs)|all diff --git a/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini b/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini index e8b443c3..17e8bef9 100644 --- a/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini +++ b/src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini @@ -1547,7 +1547,7 @@ session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; Development Value: On ; Production Value: On ; https://php.net/session.upload-progress.enabled -;session.upload_progress.enabled = On +session.upload_progress.enabled = ${PHP_SESSION_UPLOAD_PROGRESS_ENABLED} ; Cleanup the progress information as soon as all POST data has been read ; (i.e. upload completed). diff --git a/src/variations/cli/Dockerfile b/src/variations/cli/Dockerfile index c83b57a1..70c47a7c 100644 --- a/src/variations/cli/Dockerfile +++ b/src/variations/cli/Dockerfile @@ -65,6 +65,7 @@ ENV APP_BASE_DIR=/var/www/html \ PHP_REALPATH_CACHE_TTL="600" \ PHP_SESSION_COOKIE_HTTPONLY="On" \ PHP_SESSION_COOKIE_SECURE=false \ + PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \ PHP_UPLOAD_MAX_FILE_SIZE="100M" \ PHP_ZEND_DETECT_UNICODE="" \ PHP_ZEND_MULTIBYTE="Off" \ diff --git a/src/variations/fpm-apache/Dockerfile b/src/variations/fpm-apache/Dockerfile index 7847f5b3..1978e983 100644 --- a/src/variations/fpm-apache/Dockerfile +++ b/src/variations/fpm-apache/Dockerfile @@ -106,6 +106,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \ PHP_REALPATH_CACHE_TTL="600" \ PHP_SESSION_COOKIE_HTTPONLY="On" \ PHP_SESSION_COOKIE_SECURE=false \ + PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \ PHP_UPLOAD_MAX_FILE_SIZE="100M" \ PHP_ZEND_DETECT_UNICODE="" \ PHP_ZEND_MULTIBYTE="Off" \ diff --git a/src/variations/fpm-nginx/Dockerfile b/src/variations/fpm-nginx/Dockerfile index 3f50a7b9..a37e7569 100644 --- a/src/variations/fpm-nginx/Dockerfile +++ b/src/variations/fpm-nginx/Dockerfile @@ -180,6 +180,7 @@ ENV APP_BASE_DIR=/var/www/html \ PHP_REALPATH_CACHE_TTL="600" \ PHP_SESSION_COOKIE_HTTPONLY="On" \ PHP_SESSION_COOKIE_SECURE=false \ + PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \ PHP_UPLOAD_MAX_FILE_SIZE="100M" \ PHP_ZEND_DETECT_UNICODE="" \ PHP_ZEND_MULTIBYTE="Off" \ diff --git a/src/variations/fpm/Dockerfile b/src/variations/fpm/Dockerfile index e0e9ec49..720b8662 100644 --- a/src/variations/fpm/Dockerfile +++ b/src/variations/fpm/Dockerfile @@ -76,6 +76,7 @@ ENV APP_BASE_DIR=/var/www/html \ PHP_REALPATH_CACHE_TTL="600" \ PHP_SESSION_COOKIE_HTTPONLY="On" \ PHP_SESSION_COOKIE_SECURE=Off \ + PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \ PHP_UPLOAD_MAX_FILE_SIZE="100M" \ PHP_ZEND_DETECT_UNICODE="" \ PHP_ZEND_MULTIBYTE="Off" \ diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index c4edbcbb..25afb97d 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -223,6 +223,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \ PHP_REALPATH_CACHE_TTL="600" \ PHP_SESSION_COOKIE_HTTPONLY="On" \ PHP_SESSION_COOKIE_SECURE=false \ + PHP_SESSION_UPLOAD_PROGRESS_ENABLED="0" \ PHP_UPLOAD_MAX_FILE_SIZE="100M" \ PHP_ZEND_DETECT_UNICODE="" \ PHP_ZEND_MULTIBYTE="Off" \ From 8f393396bf3f59ef66e256beee32f9ccbbd9df61 Mon Sep 17 00:00:00 2001 From: Jay Rogers Date: Fri, 23 Oct 2026 12:31:05 +0000 Subject: [PATCH 2/2] Upgrade FrankenPHP to v1.13.2 --- src/variations/frankenphp/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/variations/frankenphp/Dockerfile b/src/variations/frankenphp/Dockerfile index 25afb97d..799d1c71 100644 --- a/src/variations/frankenphp/Dockerfile +++ b/src/variations/frankenphp/Dockerfile @@ -2,7 +2,7 @@ ARG BASE_OS_VERSION='trixie' ARG PHP_VERSION='8.5' ARG BASE_IMAGE="php:${PHP_VERSION}-zts-${BASE_OS_VERSION}" -ARG FRANKENPHP_VERSION='1.13.1' +ARG FRANKENPHP_VERSION='1.13.2' ARG GOLANG_VERSION='1.27' ########################