fix(wordpress): move to PHP 8.5.12 for PHP2Shell

CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35; mod_php is the highest-risk variant. The running pod reports PHP 8.3.35 and www.renner.uno serves / to the internet without the Authentik gate. Switch to the php8.5-apache variant of the same WordPress release, pinned to the index digest rebuilt on 2026-10-22 after the PHP fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-22 11:57:02 +02:00
2 changed files with 1 additions and 20 deletions
@@ -25,7 +25,7 @@ spec:
        fsGroup: 33
      containers:
        - name: wordpress
-          image: wordpress:7.1.3-php8.3-apache@sha256:8ecd8d8e374167ea22235acf30f80d1165b82f07ffa5bcef90c1cad8f7be251f
+          image: wordpress:7.1.3-php8.5-apache@sha256:ce31904fa1e51b73543fa2e35cc8f1747589b2abf48dc747b422749b88b77e9e
          ports:
            - name: http
              containerPort: 80
@@ -80,25 +80,6 @@ spec:
          # community blocklists.
          - 162.55.50.97/32
          - 2a01:4f8:c2c:4579::1/128
-      postoverflows:
-        s01-whitelist:
-          # http-crawl-non_statics counts requests regardless of outcome, so a
-          # signed-in user of any image-heavy UI (Immich timeline, Music
-          # Assistant covers) trips it with a burst of 200s. Scanners trip it
-          # with 404s for paths that do not exist. Drop the overflow unless at
-          # least half of its requests were client errors (the alert carries
-          # the scenario's last 5 events, cache_size: 5). Only this scenario
-          # is affected; probing/sensitive-files/cve still fire on their own.
-          crawl-non-statics-success-whitelist.yaml: |
-            name: krenner/crawl-non-statics-success-whitelist
-            description: "Ignore http-crawl-non_statics bursts that mostly succeeded"
-            whitelist:
-              reason: "crawl burst of successful requests is a UI, not a scanner"
-              expression:
-                - >-
-                  evt.Overflow.Alert.GetScenario() == 'crowdsecurity/http-crawl-non_statics' &&
-                  count(evt.Overflow.Alert.Events, {.GetMeta('http_status') startsWith '4'}) * 2
-                  < len(evt.Overflow.Alert.Events)

    # mTLS between agents and the LAPI. Do not switch back to password auth:
    # the LAPI runs without persistence, so its machine-registration DB is