[RubyBrewsday]

WordPress development and CI previously selected PHP releases below the fixes for CVE-2026-109618 and CVE-2026-109619. This PR requires patched, supported PHP and verifies the actual host, official-image and running-service versions before using the environment.

The official WordPress web and CLI images now contain the fixes on AMD64 and ARM64. Developer startup and CI use those official images directly; no custom image build or publication is required.

Changes

• Require PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later patches in those branches. Check the host interpreter before Composer; setup-php's patch input alone does not establish the installed version.
• Pin local mise PHP to 8.4.27 and wp-env to PHP 8.4. Guard npm startup, the hosts helper, compatibility tests and CI. Stop existing project services, pull and check both official web and CLI bases with networking disabled, recreate project-derived images while retaining volumes, and verify every enabled running web/CLI service.
• Fail closed on image pull failures, malformed/mismatched/affected versions, or startup failures. Keep phpMyAdmin disabled because its separate PHP image is not covered.
• Generate dashboards and upload artifacts only when their result files exist. Cleanup succeeds when startup was blocked before wp-env initialization, while the primary startup failure remains visible.
• Retain the plugin's PHP 7.4 compatibility declaration, Composer platform and seven required Lint (7.4) through Lint (8.5) contexts. Execute those static checks on patched PHP. Remove EOL executable matrix entries and their archived-Debian workaround. Static compatibility coverage is partial and does not replace dynamic 7.4–8.1 coverage.

Verification

• 21 runtime-policy, startup and cleanup tests pass. Coverage includes affected/unsupported PHP, registry failures, unverified/mismatched image versions, stale derived images, post-start guards, and cleanup before initialization.
• Full JavaScript lint, changed-file formatting, workflow YAML/config validation and git diff checks pass. Independent review confirms all runtime guards remain intact.
• Prior isolated Compose validation proved project-derived image replacement preserves a named-volume sentinel.
• Current head a5cdf2c819ab2f399faae72a081026331f197d8f: Lint CI passed all eight jobs. Test CI passed all eight PHPUnit matrix jobs: 89 tests / 285 assertions each, 712 executions / 2,280 assertions total. Logs verify the official base images and all four running services use the required patched PHP. At 18:19 UTC, only E2E remained running, with no failures. The successful main E2E baseline takes approximately 41 minutes (197 passed, 5 existing skips).

Image availability and rollout

At 18:10 UTC on October 21, all eight official WordPress web/CLI tags were verified on both Linux/amd64 and Linux/arm64/v8 with PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. There were no registry authentication or network errors. The upstream image-publication blocker is resolved.

Default PHP 8.4 index digests:

• wordpress:php8.4: sha256:41815427d043bc629359121b347e2f1e4b7aba502062c369c2922f1d666ebf2a
• wordpress:cli-php8.4: sha256:334307a0b693739ed31208931d9227ec3f8e2ad3bdafd6f27a662cd04cd61351

Developers must recreate existing environments through npm run env:start and confirm the logged runtime versions. Back up local content before changing WordPress/PHP versions. Direct upstream wp-env commands bypass the repository guard. Customer hosting operators must independently update PHP and restart their workers; source changes do not patch deployed systems.

This PR remains draft. No merge, deployment, plugin release, image publication or monitor was performed. References BEE-27413 without closing its broader rollout work.

References: PHP advisory, CVE-2026-109618, CVE-2026-109619.