claude-botandClaude Opus 5.5 bbeaf622ed fix(wordpress): move to PHP 8.5.12 for PHP2Shell ...

CVE-2026-109618 and CVE-2026-109619 (BSI BITS-H 2026-297981-1132) allow
unauthenticated RCE on every PHP before 8.5.12/8.4.27/8.3.36/8.2.35;
mod_php is the highest-risk variant. The running pod reports PHP 8.3.35
and www.renner.uno serves / to the internet without the Authentik gate.

Switch to the php8.5-apache variant of the same WordPress release,
pinned to the index digest rebuilt on 2026-10-22 after the PHP fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 11:57:02 +02:00

..

deployment.yaml

fix(wordpress): move to PHP 8.5.12 for PHP2Shell

2026-10-22 11:57:02 +02:00

externalsecret.yaml

refactor(secrets): one OpenBao path for the one Hetzner S3 credential

2026-08-27 21:02:28 +02:00

ingress.yaml

feat(authentik): move every app onto the SSO login (stage 2)

2026-10-15 10:41:17 +02:00

kustomization.yaml

feat(authentik-gate): migrate the remaining 12 gates to the authentik-gate class

2026-10-14 21:37:26 +02:00

mariadb.yaml

feat(wordpress): host www.renner.uno in the cluster behind an Authentik gate

2026-08-16 21:48:49 +02:00

pvc.yaml

fix(wordpress): correct the network-policy claim and make the Velero selector safe

2026-08-16 22:01:01 +02:00