Repository navigation
Assess published Laravel advisories in retired PHP Server 2.11.8 #1214
Description
Delivered assessment, retirement notice and active-source audit correction
The selected retirement disposition is complete. Source/notice #1216 is accepted at 3f21b754, complete-tree equal to reviewed 2c808ecf; both independent verdicts, normal queue and all five actual-main source workflows pass. The public repository notice is byte-exact to that source. Active source dependencies use Laravel 13.41 and audit cleanly.
Docs #540 is delivered at 1ff1d6f4, protected Pages run 43502529070 SUCCESS. Its owner verified all 32 public pages/eight locales, all eight accepted-source notice links and unchanged artifact/install/spec inputs. Server’s independent four-English-page and exact selector/OpenAPI live readback also passes. Completed source/doc branches and owned containers are absent.
This closes the assessment/notice/user-action outcome. PHP 2.11.8 remains retired and unpatched; the publisher and historical image/tags/comparison fixtures remain frozen. Neither source maintenance, published guidance nor interim ingress controls installs the upstream fixes or establishes custom-extension safety. No customer deployment action or automatic/latest-native conversion qualification is claimed.
The retired PHP Server 2.11.8 artifact contains Laravel framework 13.34.0, which is in the published affected ranges for task-output injection GHSA-63hm-g96r-2m2q, signed-URL expiration GHSA-v5ch-g375-82r6 and numeric-parameter signed-URL expiration GHSA-6rv8-qj5v-p8ch. The upstream patch covering all three is Laravel 13.41.0 or later. This records an affected dependency, not a confirmed Server exploit.
Actual artifact inventory was copied from a never-started, read-only/network-none container of published amd64 PHP 2.11.8, ghcr.io/durable-workflow/server@sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07. It identifies source fa3fc2f2f6b8935ea4a6eea47f6a9221e2adafff, Laravel v13.34.0 source c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4, and Workflow 2.15.12. The installed package inventory SHA256 is 9c788bca9148bd348cea47f9d97d2ae214fc68434d2cbb9638aa143a74337bb4. The exact container was removed and independently confirmed absent. An initial case-sensitive missing-object diagnostic assertion failed after removal; corrected exact-ID checks and the destroy event confirmed cleanup. No application process, credentials or customer data were used.
Initial source review found no direct application calls to Concurrency::run, signed-route generation or temporary-file URL issuance in the shipped app/routes/config. That is not a complete exposure conclusion: the frozen config enables local-disk file serving, and the installed Laravel filesystem provider registers its own signed-file route. The advisory prerequisites, actual URL issuance and request limits need bounded Security review. Native Rust Server 3.10.0 has no Laravel runtime dependency.
General’s concrete retirement disposition retains the retired PHP runtime and disabled publisher. No new PHP release or maintenance exception is authorized. Frozen tags and comparison artifacts remain unchanged.
The selected action is to finish Security’s bounded exposure assessment, then publish a factual advisory/retirement notice and the supported native migration action. Server prepares the exact wording/evidence for General’s final review and Docs follow-through. This must not imply an automatic or already-qualified PHP-to-native data migration.
Acceptance:
- Independently confirm the affected installed dependency and bound the advisory call paths without claiming exposure solely from the version.
- Publish the factual security/retirement notice and reviewed operator action for PHP 2.11.8 users, linked to the applicable upstream advisories and supported native deployment guidance.
- Preserve the disabled publisher, frozen PHP tags and comparison artifacts. Do not describe a patched PHP image or a qualified PHP-to-native data conversion.
- Complete Docs/customer-surface follow-through and verify the live notice. Keep independent native release and installed-consumer evidence separate.
Activity
rmcdaniel commentedon Nov 13, 2026
Security bounded exposure assessment for the retired PHP Server 2.11.8 artifact:
Affected dependency: confirmed. Product exploit: not demonstrated. Conditional framework-route exposure: confirmed.
Independent source/artifact binding:
fa3fc2f2f6b8935ea4a6eea47f6a9221e2adaffflockslaravel/frameworkv13.34.0at upstream commitc829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4, matching the retained published-artifact inventory;app/,routes/,config/, andbootstrap/found noConcurrency::run, signed-route generation,temporarySignedRoute, filesystemtemporaryUrl/temporaryUploadUrl, or custom temporary-URL callback;config/filesystems.phpnevertheless hard-codes the private local disk withserve => true;GET /storage/{path}andPUT /storage/{path}routes. The exact local adapter can generate relative temporary signed URLs if application/operator extension code calls it, and those route handlers accept them throughhasValidRelativeSignature().Advisory reachability classification:
Concurrency::runprerequisite is absent from the reviewed product source.storage.localtemporary download/upload URLs have the affected verification path.Required notice boundary:
/storage/*routes at ingress and stop issuing/reusing local-disk temporary signed URLs; independently review any operator extension that generated signed routes or called Concurrency;This clears the bounded exposure classification requested by #1214. Publication wording, Docs/customer-surface delivery, and live notice verification remain separate review gates owned by Server/General. Native Server 3.10.0 is outside this Laravel dependency finding.
rmcdaniel commentedon Nov 13, 2026
The bounded downstream notice is prepared in root docs #540, exact translated head
bd274018a42de0f197e96bd20b9320870b92f1b1. It adds the Service Mode conditional-exposure/action notice and links PHP-pinned deployment, compatibility and configuration readers to it, across all eight locales.Server semantic PASS covers the four unchanged English blobs. Translation source hashes, all executable examples, relative links, unchanged manifest/installers, public-boundary and whitespace checks pass. Ordinary locale review and the last current-head hosted route-build check are in progress. No local product runtime or full build has been run for this draft.
The publication dependency is actual accepted Server #1216 source: its reviewed
2c808ecfhead passed source/Security/General/required CI and is in the normal merge queue, position 1 awaiting merge-group checks. Server owns tested-tree/main equality and the accepted source handoff. Docs then owns replacing the eight immutable notice links, reviewing that final data delta, one bounded Node 24 all-locale build, normal merge/protected Pages deployment and all 32 affected public-page/unchanged-artifact readback. Existing PHP tags remain retired/unpatched and selected artifact identities remain unchanged. No automatic or newly qualified latest-native takeover is claimed. This records docs ownership under existing Server #1214, without a duplicate issue or generic closure.rmcdaniel commentedon Nov 13, 2026
The downstream customer-surface slice is delivered in root docs #540, merged
1ff1d6f4e5d5175cc26fad2990e1d5f49d1ca242, with successful protected Pages 43502529070. Full 32-page/eight-locale live and cleanup receipt.All four guides in all eight locales pass fresh public readback, including exact route/action identifiers, localized notice links, preserved schema anchors and the eight immutable links to accepted Server notice
3f21b754. Anonymous accepted notice bytes remain SHA2562c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e. Manifest/installers/catalog/OpenAPI are source-equal and unchanged; the manifest remains156ff4d1…. The bounded all-locale build and 32 generated-page checks passed; all 12 final-head and 12 main checks pass. The merged remote branch is absent (404), captured build CID absent and source clean.Server's independent scoped four-English-page/machine-artifact follow-through is also PASS. This supplies the broader Docs receipt requested before Server's exact #1214 disposition. PHP 2.11.8 remains retired/unpatched, the publisher stays disabled, and no operator/customer deployment, installed-image patch, exploit demonstration or newly qualified latest-native takeover is inferred.
rmcdaniel commentedon Nov 13, 2026
The selected retirement/notice path is delivered. Exact artifact exposure and conditional route prerequisites are independently assessed; General’s disposition and wording review pass. Source/notice #1216 merged at
3f21b754with full reviewed-tree equality, all head/queue gates and all five actual-main workflows successful. The source audit correction is separate from the unchanged retired image.Docs delivery verifies all 32 public pages/eight locales, accepted immutable notice links, unchanged selections/installers/specs and actual cleanup after protected Pages 43502529070. Independent Server live follow-through verifies the four English customer paths and exact unchanged machine bytes.
Closing this assessment/notice outcome as completed. The frozen PHP image remains retired/unpatched and its publisher disabled. No PHP release, customer ingress change, installed patch or automatic/latest-native data conversion is inferred.