EasyEngine/easyengine v4.13.3

EasyEngine v4.13.3

on GitHub

EasyEngine v4.13.3

Security

This release moves every enabled WordPress and PHP site on PHP 8.2, 8.3, 8.4 and 8.5 to rebuilt easyengine/php8.x images based on the PHP security releases of 2026-10-21 (8.2.35, 8.3.36, 8.4.27 and 8.5.12), which fix CVE-2026-109618 and CVE-2026-109619 ("php2shell"). Update as soon as you can:

ee cli update

Upgrade notes

WordPress and PHP sites on PHP 8.2 to 8.5 are recreated

During the update, each enabled site on PHP 8.2, 8.3, 8.4 or 8.5 is recreated on its new image, one site at a time. A temporary support container keeps serving each site while its containers are switched, and the site's nginx is reloaded once they're back. The first site of each PHP version waits while that image is downloaded (a few hundred MB to download, about 1.5 GB on disk). HTML sites, the global services and sites on other PHP versions aren't recreated. The update needs at least 5 GB of free disk space.

New PHP versions: 8.2 → 8.2.35, 8.3 → 8.3.36, 8.4 → 8.4.27, 8.5 → 8.5.12. Check a site with ee shell <site> --command='php -v'.

Disabled sites

Disabled sites are skipped by the update and keep their old image. Enable them with --refresh so they come back on the patched image: ee site enable <site> --refresh. Without --refresh, ee site enable starts the old, unpatched image again.

Session upload progress is turned off

PHP's advisory names session upload progress as an attack path for CVE-2026-109619 and recommends turning it off (and keeping it off after patching if you don't use it). As defense in depth on top of the patched images, and as the main protection for sites still on PHP 8.1 or older, which get no official PHP release, every WordPress and PHP site now has session.upload_progress.enabled = Off in its custom.ini (/opt/easyengine/sites/<site>/config/php/php/conf.d/custom.ini). The update adds it to existing sites, enabled or disabled, on every PHP version, and new sites get it from the start. Running sites pick it up with a graceful php-fpm reload during the update (or when they're recreated for the new image); disabled sites get it when you enable them. If a site's custom.ini already sets session.upload_progress.enabled, it's left as it is. The original files are kept in /opt/easyengine/.backup/session-upload-progress-wp-<timestamp>/ and …-php-<timestamp>/.

WordPress core doesn't use this feature. If your own PHP application shows upload progress through PHP sessions, turn it back on for that site: remove the line from custom.ini (or set it to On), then run ee site reload <site>. On macOS, custom.ini isn't applied by the PHP container today, so this setting has no effect there.

PHP 8.1 and older

PHP 8.1, 8.0, 7.4 and older are end of life upstream and get no official PHP release with these fixes (the PHP security team published only minimal source backports for 7.4, 8.0 and 8.1, with no tagged releases). v4.13.3 switches off session upload progress on these sites too, which blocks the confirmed session paths for CVE-2026-109619 but isn't a complete fix. Move those sites to a supported version, for example ee site update <site> --php=8.4.

Docker image updates

All other images are unchanged from v4.13.2. site-type-wp and site-type-php move from v1.12.1 to v1.12.2 (the session upload progress change above); all other command packages are unchanged.

What's Changed

• chore(release): prepare v4.13.3 #1952 @mrrobot47
• chore(deps): bump php to 8.2.35 in /php/8.2 EasyEngine/dockerfiles#365 @mrrobot47
• chore(deps): bump php to 8.3.36 in /php/8.3 EasyEngine/dockerfiles#364 @mrrobot47
• chore(deps): bump php to 8.4.27 in /php/8.4 EasyEngine/dockerfiles#363 @mrrobot47
• chore(deps): bump php to 8.5.12 in /php/8.5 EasyEngine/dockerfiles#362 @mrrobot47
• fix: disable session.upload_progress for new and existing sites EasyEngine/site-type-php#120 @mrrobot47
• fix: disable session.upload_progress for new and existing sites EasyEngine/site-type-wp#246 @mrrobot47