Thoughts on tech

PHP dropped a critical security release on Oct 21. Two unauthenticated RCEs (CVE-2026-109618 and CVE-2026-109619, collected under "PHP2Shell", both CVSS 9.2) in the parts of PHP every request touches, memory management and error handling. Patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Worst case is Apache mod_php, where an exploit ran before any application code. PHP-FPM is affected too.

I knew nextcloud was PHP. Everything else was a guess, so the first job was an inventory.

## The sweep

Loop over every running container on both docker hosts:

``` console
for c in $(docker ps --format "{{.Names}}"); do
  docker exec $c php -v 2>/dev/null | head -1
done
```

Four PHP services, all ...