[Helias]

The php container builds from wordpress:6.8-php8.3-fpm, and that tag hasn't been rebuilt since WordPress 6.9 came out, so it's stuck on PHP 8.3.28. That version is affected by the two RCEs PHP fixed yesterday (CVE-2026-109618 and CVE-2026-109619, see the advisory), and docker compose build --pull doesn't help since the tag itself never moves.

Switched to wordpress:php8.3-fpm, which is on 8.3.36 and keeps getting rebuilt. I left the WordPress version out of the tag on purpose so we don't end up here again with the next WordPress release. WordPress itself lives in the wordpress-src volume, so existing installs keep their version and only fresh installs start from the newer one.

The phpmyadmin example in data/docker/docker-compose.override.yml had the same problem: phpmyadmin/phpmyadmin is still on PHP 8.3.26 and runs Apache mod_php, which the advisory calls the highest risk. It now points to the official phpmyadmin image, which is on 8.3.36.

To pick it up: docker compose build --pull php && docker compose up -d php, plus docker compose pull phpmyadmin if you use the override.

Didn't build it locally, the CI here builds the php image and checks the containers come up. Both new images report PHP 8.3.36 on Docker Hub.

Summary by CodeRabbit

• Chores
  • Updated the application’s container configuration to maintain compatibility with the current deployment environment.
  • No changes to application functionality, content management features, administration tools, or user-facing workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b5bbf44-73ef-450d-93fd-d0b34b3fb639

📥 Commits

Reviewing files that changed from the base of the PR and between 357ceeb and 3da35a2.

📒 Files selected for processing: 2

• data/docker/Wordpress.Dockerfile
• data/docker/docker-compose.override.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The WordPress Dockerfile now uses wordpress:php8.3-fpm. The phpMyAdmin service now uses the phpmyadmin image.

Changes: Docker image references

Layer / File(s)	Summary
Update Docker image references data/docker/Wordpress.Dockerfile, data/docker/docker-compose.override.yml	The WordPress base image changed from wordpress:6.8-php8.3-fpm to wordpress:php8.3-fpm. The phpMyAdmin service image changed from phpmyadmin/phpmyadmin to phpmyadmin.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: yehonal, thescrewedsoftware

Merge Risk: ⚪ Minimal · up to 3da35

No actionable issue from these image-reference changes remains after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately describes the primary change: updating the PHP container image to PHP 8.3.36 to address the specified CVEs.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}