Stop FreshRSS + MBG WordPress until PHP is patched

CERT-EU 2026-018 (CVE-2026-109618, CVE-2026-109619, CVSS 9.2): possible
unauthenticated RCE in PHP 5 and later. Both are internet-facing and are
the only PHP workloads (FreshRSS on PHP 8.2.29, WordPress on 8.3.30), so
scale them to 0 until their images ship a fixed PHP. PVCs and the MariaDB
cluster stay as they are.

apps/templates/mbgwp-official-helm.yaml

@@ -16,6 +16,10 @@ spec:
     chart: wordpress
     helm:
       values: |
+        # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618,
+        # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP.
+        replicaCount: 0
+
         # Official WordPress image configuration
         image:
           registry: docker.io

freshrss/freshrss-deployment.yaml

@@ -8,7 +8,9 @@ metadata:
     io.kompose.service: freshrss
   name: freshrss
 spec:
-  replicas: 1
+  # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618,
+  # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP.
+  replicas: 0
   selector:
     matchLabels:
       io.kompose.service: freshrss