From 842f087da7bca5c20b66680e415ed15bfadaa429 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Wed, 21 Oct 2026 20:36:53 +0200 Subject: [PATCH] mbgwp: start again on PHP 8.3.36 wordpress:7.1.3-php8.3-apache was rebuilt at 15:57 UTC on PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619. WordPress core lives on the volume, so the tag only moves PHP (8.3.30 -> 8.3.36) and Apache. Its ca-certificates (20250419+deb13u1) no longer carries the roots above the compromised eMudhra intermediates either. --- apps/templates/mbgwp-official-helm.yaml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/apps/templates/mbgwp-official-helm.yaml b/apps/templates/mbgwp-official-helm.yaml index b66396d..87a771b 100644 --- a/apps/templates/mbgwp-official-helm.yaml +++ b/apps/templates/mbgwp-official-helm.yaml @@ -16,15 +16,13 @@ spec: chart: wordpress helm: values: | - # Stopped until PHP is patched (CERT-EU 2026-018, CVE-2026-109618, - # CVE-2026-109619). Set back to 1 once the image ships a fixed PHP. - replicaCount: 0 - - # Official WordPress image configuration + # Official WordPress image configuration. WordPress core lives on the + # volume, so the tag only sets PHP and Apache; 7.1.3-php8.3-apache + # ships PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619. image: registry: docker.io repository: wordpress - tag: "6.9.1-apache" + tag: "7.1.3-php8.3-apache" pullPolicy: IfNotPresent # Disable embedded MariaDB