The Docker image runs PHP 8.5.12, which fixes PHP2Shell (CVE-2026-109618, CVE-2026-109619): two flaws that let an attacker without an account run code on the server when a request ends abnormally. Every earlier image runs an affected PHP. Dependencies are up to date (Laravel 13.38, Livewire 4.4.8, Octane 2.22, Vite 8.3.5). Update now: docker compose pull and docker compose up -d. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>