php: pin the shared interpreter to 8.5.12 for CVE-2026-109618/-109619

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 2026-10-21 to fix two
critical vulnerabilities in PHP itself:

  CVE-2026-109618  RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)
  CVE-2026-109619  RCE via stale global state (GHSA-6wmf-4rv5-p3rp)

Both are unauthenticated RCE, CVSS v4.0 9.2, and PHP states that updating is
the only complete mitigation.  The advisories name PHP-FPM as susceptible, so
the phpfpm-nextcloud and phpfpm-wordpress pools are in scope, not just the
Apache/mod_php configuration the public write-ups focus on.

nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 on the same
day, but the revision this flake pins (7694c4f6b853, 2026-10-16) predates it
and still reports php85 8.5.11 — as does the pinned nixos-26.05 rev, so
`pkgs.stable` is not a way out of this either.  Rather than pin the whole
nixpkgs input forward and freeze every other package, pin the interpreter:

  • phpSecurityFloor records the first patched 8.5.x release.
  • phpBase falls through to pkgs.php85 untouched when nixpkgs has caught up,
    so the workaround retires itself; bump the floor only upward.
  • `.override` rather than `overrideAttrs`: php85 is a makeOverridable
    buildEnv, so version/phpSrc reach generic.nix while the default extension
    set survives.  overrideAttrs would keep the new source but drop `enabled`,
    silently removing gd, intl, pdo_pgsql and the rest from both pools.

Nothing else changes: one interpreter, one extension set, one php.ini, and
every consumer (both FPM pools, the Nextcloud cron job, occ and wp-cli) still
resolves through config.sovran_systemsOS.phpPackage, so CLI and FPM stay in
lockstep at 8.5.12.

The source is php-8.5.12.tar.bz2 from php.net, hashed here.  Hydra cannot have
this exact derivation, so the first rebuild compiles PHP plus bz2, apcu, redis,
imagick and memcached locally — a one-off cost, after which it is a store path
like any other and the configuration stays reproducible.

`nixos-rebuild switch` is enough: the phpfpm units change closure and restart,
no reboot and no staged generation required.

CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.2.2] - 2026-10-21
+
+### Changed
+- **Nixpkgs Update (`nixpkgs-stable` / `nixos-26.05`):**
+  - Updated to commit [`cd4ea8d`](https://github.com/NixOS/nixpkgs/commit/cd4ea8d57de16f4810bc5f14207bac45fbf19f67)
+  - Upgraded **Matrix Synapse**: `1.162.0` → `1.163.0` (automatically picked up by The Hub)
+- **Sovran_Bitcoin Update (`1.1.2`):**
+  - Updated to commit [`63e1049`](https://github.com/naturallaw777/Sovran_Bitcoin/commit/63e104940ef4ff21eb2b43977ca6e110e9c5d524)
+  - Hotfix for Nostr Wallet Connect (NWC): fixes spending on LND 0.21, real internal preimages, and `pay_keysend` support
+
+### Fixed
+- Make Hub login verification loadable and diagnosable
+- Trusted Hub icon, truthful root hint, no Default-keyring prompt
+- Hub login must accept the password the desktop accepts
+- Don't let password verification crash the System Passwords tile
+[1.2.2]: https://git.sovransystems.com/Sovran_Systems/Sovran_SystemsOS/releases/tag/v1.2.2
+
+
 ## [1.2.1] - 2026-10-18
 
 ### Added

README.md

@@ -21,9 +21,9 @@ Lightning infrastructure, private cloud, and communications platform when you
 are ready.
 
 [Visit the Website](https://sovransystems.com) ·
-[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso) ·
+[Download the ISO](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso) ·
 [Try it safely in a VM](#try-it-first-in-a-virtual-machine) ·
-[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso.sha256) ·
+[Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso.sha256) ·
 [Build from Source](#build-from-source)
 
 <img src="assets/desktop-screenshot.webp" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
@@ -401,8 +401,8 @@ with an imaging application such as [Balena Etcher](https://etcher.balena.io).
 
 ### 1. Download the ISO and checksum
 
-- [Download Sovran_SystemsOS-1.2.1.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso)
-- [Download Sovran_SystemsOS-1.2.1.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso.sha256)
+- [Download Sovran_SystemsOS-1.2.2.iso](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso)
+- [Download Sovran_SystemsOS-1.2.2.iso.sha256](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso.sha256)
 
 The download may take some time. Do not rename or modify the ISO before
 verifying it, and keep both files in the same folder.
@@ -419,13 +419,13 @@ ISO must match the published one exactly.
 Open a terminal in the download folder and run:
 
 ```bash
-sha256sum --check Sovran_SystemsOS-1.2.1.iso.sha256
+sha256sum --check Sovran_SystemsOS-1.2.2.iso.sha256
 ```
 
 A successful comparison reports:
 
 ```text
-Sovran_SystemsOS-1.2.1.iso: OK
+Sovran_SystemsOS-1.2.2.iso: OK
 ```
 
 </details>
@@ -436,11 +436,11 @@ Sovran_SystemsOS-1.2.1.iso: OK
 Open Terminal in the download folder and run:
 
 ```bash
-shasum -a 256 Sovran_SystemsOS-1.2.1.iso
+shasum -a 256 Sovran_SystemsOS-1.2.2.iso
 ```
 
 Compare the value shown in Terminal with the value inside
-`Sovran_SystemsOS-1.2.1.iso.sha256`.
+`Sovran_SystemsOS-1.2.2.iso.sha256`.
 
 </details>
 
@@ -450,7 +450,7 @@ Compare the value shown in Terminal with the value inside
 Open PowerShell in the download folder and run:
 
 ```powershell
-Get-FileHash .\Sovran_SystemsOS-1.2.1.iso -Algorithm SHA256
+Get-FileHash .\Sovran_SystemsOS-1.2.2.iso -Algorithm SHA256
 ```
 
 Compare the value under `Hash` with the published checksum.
@@ -465,7 +465,7 @@ match exactly.
 
 1. Download and install [Balena Etcher](https://etcher.balena.io), then
    connect the USB drive.
-2. Choose **Flash from file** and select `Sovran_SystemsOS-1.2.1.iso`.
+2. Choose **Flash from file** and select `Sovran_SystemsOS-1.2.2.iso`.
 3. Choose **Select target**, select the USB drive, and review your selection
    carefully.
 4. Choose **Flash** and wait for the writing and verification process to
@@ -883,7 +883,7 @@ primary location for collaboration. Please read our
 ## Privacy. Sovereignty. Bitcoin.
 
 [Visit Sovran Systems](https://sovransystems.com) ·
-[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.1.iso) ·
+[Download Sovran_SystemsOS](https://downloads.sovransystems.com/Sovran_SystemsOS-1.2.2.iso) ·
 [View the License](LICENSE)
 
 </div>

VERSION

@@ -1 +1 @@
-1.2.1
+1.2.2

app/sovran_systemsos_web/versions.json

@@ -9,7 +9,7 @@
   "btcpayserver.service": "2.4.5",
   "albyhub.service": "2.0.0",
   "mempool.service": "3.3.1",
-  "matrix-synapse.service": "1.162.0",
+  "matrix-synapse.service": "1.163.0",
   "livekit.service": "1.13.8",
   "vaultwarden.service": "1.37.4",
   "haven-relay.service": "1.2.2"

flake.lock

@@ -5,11 +5,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1792157233,
-        "narHash": "sha256-XQnyEc+Pj0Tg21ckbPMri0fiK/exCzhBw6wNgd1INqw=",
+        "lastModified": 1792500275,
+        "narHash": "sha256-Y86rSoq9EWo6538kYoWZCnH9+bl0jNS1vQrnNvm8znE=",
         "owner": "emmanuelrosa",
         "repo": "btc-clients-nix",
-        "rev": "990d29e23437f30b8573f640d3e323167de1dc7b",
+        "rev": "487c7e9ce3978601d37ac10b18610db672850f3b",
         "type": "github"
       },
       "original": {
@@ -56,11 +56,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1792030654,
-        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
+        "lastModified": 1792503283,
+        "narHash": "sha256-vhe2jyvRCgufWPqDuDq1S3t3ypE+ka46IFutV02xKso=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "github"
       },
       "original": {
@@ -72,11 +72,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1792094642,
-        "narHash": "sha256-zp8ToDMnqZcu4o4IH9pdwXFXGp7yLm/M0dEnNWnyd7I=",
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fe13242281a67641c0102cdb1087f0ebe586c7df",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -104,11 +104,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1791956154,
-        "narHash": "sha256-jBYGPi4udQ9uo4KQp9m2J0546nJVQitG15gvZSaVVAs=",
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55bfb4d7437bd4e09ab7cba58a43bd68eb310044",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
@@ -152,11 +152,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1792372617,
-        "narHash": "sha256-MLFWEcj6ZyFgFWubNPYK7IEI8NUtjbrhxhXQiI6JbPM=",
+        "lastModified": 1792602201,
+        "narHash": "sha256-5LkFX16SxgXyaUDvFPtHdFGp4w4deqQy9btRmPQSlwU=",
         "owner": "naturallaw777",
         "repo": "Sovran_Bitcoin",
-        "rev": "78e4430525069172a8d1a9c08a951f8b87a03bf3",
+        "rev": "63e104940ef4ff21eb2b43977ca6e110e9c5d524",
         "type": "github"
       },
       "original": {

modules/php.nix

@@ -18,9 +18,42 @@
 #
 # To fall back to PHP 8.4 (nixpkgs' current default `pkgs.php`) change only
 # the `phpBase` line below.
+#
+# Security floor (October 2026):
+#   CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via
+#   stale global state) are critical, unauthenticated flaws in PHP itself,
+#   CVSS v4.0 9.2 each, fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 on
+#   2026-10-21.  PHP-FPM is named as susceptible in both advisories, so the
+#   pools below are in scope; updating is the only complete mitigation.
+#   nixpkgs bumped php85 in 81513f364091c759812f716cef3c175109d07342 the same
+#   day, but the nixpkgs revision this flake pins predates it, so the floor is
+#   enforced here.  Once flake.lock is at or past that commit the `else`
+#   branch below stops being taken and can be deleted.
 
 let
-	phpBase = pkgs.php85;
+	# The first 8.5.x release that carries the fixes above.  Bump only upward.
+	phpSecurityFloor = "8.5.12";
+
+	# php-8.5.12.tar.bz2, the same artifact and URL shape nixpkgs' own
+	# generic.nix fetches.  Verified against php.net on 2026-10-23.
+	phpSourceHash = "sha256-/7YO3EN87WO1E35JhNs3moERxQBJxxFRDYuVgnfvwag=";
+
+	# `.override` (not `overrideAttrs`) on purpose: php85 is a `makeOverridable`
+	# buildEnv, so this threads `version`/`phpSrc` into generic.nix while
+	# keeping the default extension set.  `overrideAttrs` would keep the new
+	# source but drop the extension set, which would silently strip gd, intl,
+	# pdo_pgsql and friends out of the pools below.
+	phpBase =
+		if lib.versionAtLeast pkgs.php85.version phpSecurityFloor then
+			pkgs.php85
+		else
+			pkgs.php85.override {
+				version = phpSecurityFloor;
+				phpSrc = pkgs.fetchurl {
+					url = "https://www.php.net/distributions/php-${phpSecurityFloor}.tar.bz2";
+					hash = phpSourceHash;
+				};
+			};
 
 	custom-php = phpBase.buildEnv {
 		# `enabled` is nixpkgs' default extension set.  It already contains every