[Geda173]

Description

PHP released fixes today for two critical unauthenticated RCE vulnerabilities, CVE-2026-109618 (memory corruption during OOM handling) and CVE-2026-109619 (stale global state across requests). Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All web SAPIs are affected, including PHP-FPM and Apache mod_php. Announcement: https://www.php.net/index.php#2026-10-20-1

Changes in this PR:

• Dockerfile: pin FROM php:8.5.12-fpm. The changed tag is a cache miss on every host, so pulling this commit and rebuilding is enough to get the patched PHP. Dependabot's docker ecosystem is already configured for the root Dockerfile and the auto-merge workflow covers patch bumps, so future PHP point releases land automatically. With the floating tag dependabot had nothing to track.
• README.md: add a docker compose pull ogamex-phpmyadmin step to the upgrade instructions, before the rebuild.
• deploy-main.yml and deploy-release.yml: pull the phpMyAdmin image before up -d --build, so main.ogamex.dev and release.ogamex.dev get the patched phpMyAdmin on the next deploy. The app images on those servers were already re-pulled on each deploy because of the prune step, but the phpMyAdmin container keeps its image alive through the prune.

No application code or PHP configuration changes. The php.net mitigations (memory_limit, post_max_size, session.upload_progress) are only partial workarounds and are not needed once the image is updated.

Type of Change:

• Bug fix
• Feature enhancement
• Documentation update
• Other (please describe):

Related Issues

Fixes #[issue-number]

Checklist

Before submitting this pull request, ensure all following requirements as outlined in CONTRIBUTING.md are met:

• Automated Refactoring: Rector has been run and no outstanding issues remain.
• Code Standards: Code adheres to PSR-12 coding standards. Verified with Laravel Pint.
• Static Analysis: Code passes PHPStan static code analysis.
• Testing:
  • Relevant unit and feature tests are included or updated.
  • Tests successfully run locally.
• Manual Testing: Change has been verified in the running application (describe briefly in the Additional Information section).
• CSS & JS Build: CSS and JS assets are compiled using Vite (npm run build) if any changes are made to JS/CSS files.
• Documentation: Documentation has been updated to reflect any changes made.

Additional Information

Add any additional context, screenshots, or explanations to help reviewers understand your PR. If this change introduces any breaking changes or significant impacts, please detail them here.

[jackbayliss]

Seems reasonable to me, nice