From bef5ddce092ea3e6d596e18ad415a6c862865b01 Mon Sep 17 00:00:00 2001 From: Linus Gasser Date: Wed, 21 Oct 2026 16:11:53 +0200 Subject: [PATCH] chore: publish 16.2.1+35.0.2-fpm release Co-Authored-By: Claude Opus 5.5 --- release/16.2.1+35.0.2-fpm | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 release/16.2.1+35.0.2-fpm diff --git a/release/16.2.1+35.0.2-fpm b/release/16.2.1+35.0.2-fpm new file mode 100644 index 0000000..4780567 --- /dev/null +++ b/release/16.2.1+35.0.2-fpm @@ -0,0 +1,12 @@ +Interim mitigations for the critical PHP RCE vulnerabilities CVE-2026-109618 +and CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5). +The nextcloud:35.0.2-fpm image still ships PHP 8.5.11; a patched image is not +yet available. Upgrade as soon as one with PHP >= 8.5.12 is released. + +Added to the PHP-FPM pool (fpm-tune.ini, FPM_TUNE_VERSION v6): + +- memory_limit = -1 (PHP_MEMORY_LIMIT is ignored for web requests) +- post_max_size = 32M, upload_max_filesize = 30M (PHP_UPLOAD_LIMIT is ignored + for web requests). WebDAV/chunked uploads use PUT and are not affected. +- session.upload_progress.enabled = off +- fatal_error_backtraces = off