From 1efa132f9d079a6d3fb4ddd60dda683c92c5c4e9 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Wed, 21 Oct 2026 09:18:24 +0200 Subject: [PATCH] Stop FreshRSS + MBG WordPress until PHP is patched CERT-EU 2026-018 (CVE-2026-109618, CVE-2026-109619, CVSS 9.2): possible unauthenticated RCE in PHP 5 and later. Both are internet-facing and are the only PHP workloads (FreshRSS on PHP 8.2.29, WordPress on 8.3.30), so scale them to 0 until their images ship a fixed PHP. PVCs and the MariaDB cluster stay as they are. --- apps/templates/mbgwp-official-helm.yaml | 4 ++++ freshrss/freshrss-deployment.yaml | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/templates/mbgwp-official-helm.yaml b/apps/templates/mbgwp-official-helm.yaml index 3701934..b66396d 100644 --- a/apps/templates/mbgwp-official-helm.yaml +++ b/apps/templates/mbgwp-official-helm.yaml @@ -16,6 +16,10 @@ spec: chart: wordpress helm: values: | + # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618, + # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP. + replicaCount: 0 + # Official WordPress image configuration image: registry: docker.io diff --git a/freshrss/freshrss-deployment.yaml b/freshrss/freshrss-deployment.yaml index 2be5ff2..6517555 100644 --- a/freshrss/freshrss-deployment.yaml +++ b/freshrss/freshrss-deployment.yaml @@ -8,7 +8,9 @@ metadata: io.kompose.service: freshrss name: freshrss spec: - replicas: 1 + # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618, + # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP. + replicas: 0 selector: matchLabels: io.kompose.service: freshrss