From 66792570626b20dfa311b4018e68ea6ca754d387 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Wed, 21 Oct 2026 11:55:54 -0300
Subject: [PATCH 1/2] fix(security): require PHP patched for critical RCEs

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .docker/Dockerfile.php81         | 2 ++
 .docker/Dockerfile.php82         | 5 +++++
 .docker/Dockerfile.php83         | 5 +++++
 .github/workflows/docker-php.yml | 5 ++---
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.docker/Dockerfile.php81 b/.docker/Dockerfile.php81
index 97799cd..e2d7b94 100644
--- a/.docker/Dockerfile.php81
+++ b/.docker/Dockerfile.php81
@@ -1,3 +1,5 @@
+# UNSUPPORTED: PHP 8.1 has no official security release for CVE-2026-109618/109619.
+# This Dockerfile is kept for historical reference and excluded from GHCR publishing.
 FROM php:8.1-fpm
 
 RUN apt-get update \
diff --git a/.docker/Dockerfile.php82 b/.docker/Dockerfile.php82
index 2a32a00..8a76017 100644
--- a/.docker/Dockerfile.php82
+++ b/.docker/Dockerfile.php82
@@ -1,5 +1,10 @@
 FROM php:8.2-fpm
 
+# Stop builds before publication when upstream PHP still lacks the October 2026 RCE fixes.
+# CVE-2026-109618 / CVE-2026-109619; unsupported PHP branches fail closed.
+RUN php -r '$minimum = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"]; $series = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION; if (!isset($minimum[$series]) || version_compare(PHP_VERSION, $minimum[$series], "<")) { fwrite(STDERR, "Unpatched or unsupported PHP runtime: " . PHP_VERSION . PHP_EOL); exit(1); }'
+
+
 RUN apt-get update \
     && apt-get install -y \
         busybox-static \
diff --git a/.docker/Dockerfile.php83 b/.docker/Dockerfile.php83
index 31addf5..fce0419 100644
--- a/.docker/Dockerfile.php83
+++ b/.docker/Dockerfile.php83
@@ -1,5 +1,10 @@
 FROM php:8.3-fpm
 
+# Stop builds before publication when upstream PHP still lacks the October 2026 RCE fixes.
+# CVE-2026-109618 / CVE-2026-109619; unsupported PHP branches fail closed.
+RUN php -r '$minimum = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"]; $series = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION; if (!isset($minimum[$series]) || version_compare(PHP_VERSION, $minimum[$series], "<")) { fwrite(STDERR, "Unpatched or unsupported PHP runtime: " . PHP_VERSION . PHP_EOL); exit(1); }'
+
+
 RUN apt-get update \
     && apt-get install -y \
         busybox-static \
diff --git a/.github/workflows/docker-php.yml b/.github/workflows/docker-php.yml
index 7d1cb40..9de6fe5 100644
--- a/.github/workflows/docker-php.yml
+++ b/.github/workflows/docker-php.yml
@@ -20,12 +20,9 @@ jobs:
       fail-fast: false
       matrix:
         container:
-          - php81
           - php82
           - php83
         include:
-          - container: php81
-            version: '8.1'
           - container: php82
             version: '8.2'
           - container: php83
@@ -65,6 +62,7 @@ jobs:
       - name: Build container image
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
+          pull: true
           push: false
           context: .docker/
           platforms: linux/amd64,linux/arm64
@@ -77,6 +75,7 @@ jobs:
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         if: github.ref == 'refs/heads/main'
         with:
+          pull: true
           push: true
           context: .docker/
           platforms: linux/amd64,linux/arm64

From 180c3e3402b5d29a22932f8be975038abe56896e Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:14:46 -0300
Subject: [PATCH 2/2] fix(ci): pin patched PHP bases and repair Buildx
 references

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .docker/Dockerfile.php82           | 5 +----
 .docker/Dockerfile.php83           | 5 +----
 .github/workflows/docker-nginx.yml | 1 +
 .github/workflows/docker-php.yml   | 3 +--
 4 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/.docker/Dockerfile.php82 b/.docker/Dockerfile.php82
index 8a76017..a9223cc 100644
--- a/.docker/Dockerfile.php82
+++ b/.docker/Dockerfile.php82
@@ -1,8 +1,5 @@
-FROM php:8.2-fpm
+FROM php:8.2.35-fpm@sha256:a58479410c94b3f0f7dfacc27fba8befc122290743fd0eb8c88a99ff2a0b1ba1
 
-# Stop builds before publication when upstream PHP still lacks the October 2026 RCE fixes.
-# CVE-2026-109618 / CVE-2026-109619; unsupported PHP branches fail closed.
-RUN php -r '$minimum = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"]; $series = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION; if (!isset($minimum[$series]) || version_compare(PHP_VERSION, $minimum[$series], "<")) { fwrite(STDERR, "Unpatched or unsupported PHP runtime: " . PHP_VERSION . PHP_EOL); exit(1); }'
 
 
 RUN apt-get update \
diff --git a/.docker/Dockerfile.php83 b/.docker/Dockerfile.php83
index fce0419..c6e8791 100644
--- a/.docker/Dockerfile.php83
+++ b/.docker/Dockerfile.php83
@@ -1,8 +1,5 @@
-FROM php:8.3-fpm
+FROM php:8.3.36-fpm@sha256:d0dea3f5d95314eac94a732469f4cf0ee658a22c2ce3f2612272b9d5b42d1a72
 
-# Stop builds before publication when upstream PHP still lacks the October 2026 RCE fixes.
-# CVE-2026-109618 / CVE-2026-109619; unsupported PHP branches fail closed.
-RUN php -r '$minimum = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"]; $series = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION; if (!isset($minimum[$series]) || version_compare(PHP_VERSION, $minimum[$series], "<")) { fwrite(STDERR, "Unpatched or unsupported PHP runtime: " . PHP_VERSION . PHP_EOL); exit(1); }'
 
 
 RUN apt-get update \
diff --git a/.github/workflows/docker-nginx.yml b/.github/workflows/docker-nginx.yml
index 9e4cde5..f84238a 100644
--- a/.github/workflows/docker-nginx.yml
+++ b/.github/workflows/docker-nginx.yml
@@ -25,6 +25,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
       - name: Set up Docker Buildx
+        id: buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Cache Docker layers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
diff --git a/.github/workflows/docker-php.yml b/.github/workflows/docker-php.yml
index 9de6fe5..354981f 100644
--- a/.github/workflows/docker-php.yml
+++ b/.github/workflows/docker-php.yml
@@ -1,8 +1,6 @@
 name: 'Docker PHP Publish'
 
 on:
-  schedule:
-    - cron: '0 2 * * *'
   pull_request:
   push:
     branches:
@@ -36,6 +34,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
       - name: Set up Docker Buildx
+        id: buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Cache Docker layers
         id: docker-cache