[Coysh]

What

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix two critical unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619). Any site below those on its branch now gets a critical php_known_vulnerability finding on the Security screen, delivered through the existing finding.opened alert path. PHP 8.1 and older have no fixed release and are always affected.

The advisories are a list in PhpAdvisories, matched against the PHP version in the inventory every site already sends. The rule needs no capability, and there is no protocol or connector change, so the next advisory is a platform release only.

What the finding refuses to claim

• Distribution packages. A Debian-family suffix (8.3.6-1ubuntu1.2) is raised as high and asks the reader to check their vendor, since the fix may be backported under the older number. Red Hat packages carry no suffix, so they read as critical; the text says to acknowledge those.
• CLI versus web. A site whose queue runs from cron reports the command-line PHP. The finding says it may differ from the web server's, and calls out apache2handler (mod_php) as the highest risk.
• Mitigations. Listed, never used to lower the severity. session.upload_progress.enabled and fatal_error_backtraces are not reported, so Manager cannot tell a mitigated site from an exposed one.
• Acknowledgements use ResetsAcknowledgement: they cover the advisories named when they were made and reopen if a later advisory applies.

Fleet view

/security?rule=<key> lists only the sites with that finding and says how many of the fleet that is, with an "Every site with this" link beside every finding. A key that is not a security rule is ignored and the whole fleet is shown, so a typo cannot read as a clean fleet.

Other changes worth reviewing

• The factories' default PHP moves from 8.3.14 to 8.5.12. Left alone, every test that evaluates a default site would gain a critical finding and a notification (seven tests failed on exactly that). A comment on the factory says to raise it rather than special-case tests when a later advisory outpaces it.
• The audit entry written when an acknowledgement is withdrawn said "The certificate was renewed" whatever the rule. It is now generic. Nothing asserted the old wording.
• docs/rollback.md moves to 1.9.1, because DocumentedVersionTest requires it to name the release before the current one.

Verification

Run in the ddev container from a clone of this branch with its own test database:

• Pest: full suite, 1617 passed (643 of them Invariants), including the new rule, advisory and Security screen tests.
• Pint: clean. PHPStan: no errors.
• npm run build on this tree and on pristine main give identical hashes, so public/build is unchanged.

CHANGELOG.md has a 1.10.0 entry in the same commit (1.9.1 is tagged). No migrations, no configuration, nothing to do on upgrade.

Not in this PR

Reporting the two unreported settings, and capturing web-SAPI values rather than the queue's, needs a new system.v5 schema and a connector release. Until then the finding cannot tell a mitigated site from an exposed one.