PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 2026-10-21 to fix two
critical vulnerabilities in PHP itself:
CVE-2026-109618 RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)
CVE-2026-109619 RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
Both are unauthenticated RCE, CVSS v4.0 9.2, and PHP states that updating is
the only complete mitigation. The advisories name PHP-FPM as susceptible, so
the phpfpm-nextcloud and phpfpm-wordpress pools are in scope, not just the
Apache/mod_php configuration the public write-ups focus on.
nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 on the same
day, but the revision this flake pins (7694c4f6b853, 2026-10-16) predates it
and still reports php85 8.5.11 — as does the pinned nixos-26.05 rev, so
`pkgs.stable` is not a way out of this either. Rather than pin the whole
nixpkgs input forward and freeze every other package, pin the interpreter:
• phpSecurityFloor records the first patched 8.5.x release.
• phpBase falls through to pkgs.php85 untouched when nixpkgs has caught up,
so the workaround retires itself; bump the floor only upward.
• `.override` rather than `overrideAttrs`: php85 is a makeOverridable
buildEnv, so version/phpSrc reach generic.nix while the default extension
set survives. overrideAttrs would keep the new source but drop `enabled`,
silently removing gd, intl, pdo_pgsql and the rest from both pools.
Nothing else changes: one interpreter, one extension set, one php.ini, and
every consumer (both FPM pools, the Nextcloud cron job, occ and wp-cli) still
resolves through config.sovran_systemsOS.phpPackage, so CLI and FPM stay in
lockstep at 8.5.12.
The source is php-8.5.12.tar.bz2 from php.net, hashed here. Hydra cannot have
this exact derivation, so the first rebuild compiles PHP plus bz2, apcu, redis,
imagick and memcached locally — a one-off cost, after which it is a store path
like any other and the configuration stays reproducible.
`nixos-rebuild switch` is enough: the phpfpm units change closure and restart,
no reboot and no staged generation required.
Sovran Systems
naturallaw777
copilot-swe-agent[bot]andnaturallaw777