PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 2026-10-21 to fix two
critical vulnerabilities in PHP itself:
CVE-2026-109618 RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)
CVE-2026-109619 RCE via stale global state (GHSA-6wmf-4rv5-p3rp)
Both are unauthenticated RCE, CVSS v4.0 9.2, and PHP states that updating is
the only complete mitigation. The advisories name PHP-FPM as susceptible, so
the phpfpm-nextcloud and phpfpm-wordpress pools are in scope, not just the
Apache/mod_php configuration the public write-ups focus on.
nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 on the same
day, but the revision this flake pins (7694c4f6b853, 2026-10-16) predates it
and still reports php85 8.5.11 — as does the pinned nixos-26.05 rev, so
`pkgs.stable` is not a way out of this either. Rather than pin the whole
nixpkgs input forward and freeze every other package, pin the interpreter:
• phpSecurityFloor records the first patched 8.5.x release.
• phpBase falls through to pkgs.php85 untouched when nixpkgs has caught up,
so the workaround retires itself; bump the floor only upward.
• `.override` rather than `overrideAttrs`: php85 is a makeOverridable
buildEnv, so version/phpSrc reach generic.nix while the default extension
set survives. overrideAttrs would keep the new source but drop `enabled`,
silently removing gd, intl, pdo_pgsql and the rest from both pools.
Nothing else changes: one interpreter, one extension set, one php.ini, and
every consumer (both FPM pools, the Nextcloud cron job, occ and wp-cli) still
resolves through config.sovran_systemsOS.phpPackage, so CLI and FPM stay in
lockstep at 8.5.12.
The source is php-8.5.12.tar.bz2 from php.net, hashed here. Hydra cannot have
this exact derivation, so the first rebuild compiles PHP plus bz2, apcu, redis,
imagick and memcached locally — a one-off cost, after which it is a store path
like any other and the configuration stays reproducible.
`nixos-rebuild switch` is enough: the phpfpm units change closure and restart,
no reboot and no staged generation required.
- Ensure bitcoind enables rest=1 and electrs.service omits the removed
--daemon-p2p-addr flag even before Sovran_Bitcoin flake input is re-locked.
- Clean up pre-0.12.0 (FixedPrefix.8) RocksDB directories in electrs
preStart so bindex 0.12.0 reindexes cleanly.
Updater/rebuild self-heal:
- Add a shared run_step wrapper used by both the update and rebuild
scripts. On the first failure matching a transient fetch/cache signature
(truncated tarball, corrupt NAR, hash mismatch, network timeout,
interrupted download), clear Nix's fetch caches and repair the store,
then retry once. Real config errors do not match and still fail loudly.
- The kernel-change boot fallback in the rebuild path is also wrapped.
- Fixes the reported 'cannot read file from tarball: Truncated tar archive
detected' failure, which a plain re-run cannot clear because Nix reuses
the corrupt cached archive.
Failed-update recovery / reporting:
- check_for_updates() now compares the running Hub version against the
branch VERSION, so a failed 'nix flake update' (lock advanced but no
generation staged) can no longer masquerade as 'up to date' and block
retries.
- /api/updates/check surfaces a persistent 'failed' state; /api/updates/run
never blocks a retry after a failure.
- Dashboard shows a red 'Update failed - click to retry' tile; the modal
offers a Retry Update button and stops offering a reboot on failure.
The LND-only rewrite of lndconnect.nix shipped a wrapper Zeus cannot
use: unknown flags (--cert/--macaroon), a non-existent onion path
(free/lnd.onion), and a REST hidden service that collided with LND's
P2P onion. Restore the nix-bitcoin contract — dedicated lnd-rest
onion on port 8080, --nocert over Tor, admin macaroon in the URI —
and only persist a valid lndconnect:// URI for the Hub QR.
Sovran Systems