[renovate]

This PR contains the following updates:

Package	Update	Change
php	patch	8.5.11 → 8.5.12

⚠️ PHP2Shell vulnerabilities can allow remote code execution. This PR updates affected PHP versions to patched releases. Rebuild affected images, deploy the updates, and restart PHP workers.

Details: CVE-2026-109618 and CVE-2026-109619.

---

Release Notes

php/php-src (php)

v8.5.12: PHP 8.5.12

Compare Source

The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately.

There are no complete mitigations, updating is the only safe choice. See the security advisory for details.

For source downloads of PHP 8.5.12 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fdd21e9b-f77f-4b4e-94ad-62f5dddddbe3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}