fix(birdnet-pi, birdnet-pi-zach, battybirdnet-pi): patch PHP CVE-2026-109618/109619 (#3179)

* fix(birdnet-pi, birdnet-pi-zach, battybirdnet-pi): patch PHP CVE-2026-109618/109619

Upgrade the PHP packages to the Debian-patched release at build time.
Reported by rdz-oss in rdz-oss/BattyBirdNET-Pi discussion #150.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* fix(birdnet-pi): reuse apt lists from earlier in the RUN for the PHP upgrade

The second apt-get update hit a transient 'Cannot allocate memory' reading the backports index on the CI runner.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* fix(birdnet-pi): fail the build if php8.2-fpm is still below 8.2.35

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

battybirdnet-pi/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 - Local disks: `localdisks` can now mount a single folder of a disk with `disk/folder` (e.g. `sda1/public` or `NAS/public`, mounted at `/mnt/<disk>/<folder>`). Existing values are unchanged.
 - Migrate legacy add-on configuration map names to current app configuration terminology.
 ## 2026.02.28 (28-02-2026)

battybirdnet-pi/Dockerfile

@@ -114,6 +114,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*

battybirdnet-pi/config.yaml

@@ -118,5 +118,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/battybirdnet-pi
 usb: true
-version: "2026.02.28"
+version: "2026.10.31"
 video: true

birdnet-pi-zach/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 ## 2026.10.28.1 (28-10-2026)
 - Fix: restarting the services no longer leaves a previous `daily_plot.py` or recording loop running next to the new one. `restart_services.sh` now clears leftover `daily_plot.py`, `birdnet_recording.sh`, and `ffmpeg`/`arecord` recorders writing to `StreamData` once the recorder is stopped (port of the birdnet-pi fix for #3152)
 - Fix: an unreachable audio source (RTSP host switched off, missing soundcard) no longer causes a restart loop with growing RAM. The monitoring service now reports the silent source instead of restarting when there is nothing queued to analyze, and limits the static `analyzing_now.txt` restart path to once every 30 minutes

birdnet-pi-zach/Dockerfile

@@ -120,6 +120,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*

birdnet-pi-zach/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi-zach
 usb: true
-version: "2026.10.28.1"
+version: "2026.10.31"
 video: true

birdnet-pi/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 2026.10.31 (31-10-2026)
+- Security: upgrade the PHP packages to the Debian-patched release at build time (the build fails if php8.2-fpm is still below 8.2.35), fixing CVE-2026-109618 (out-of-memory leading to remote code execution) and CVE-2026-109619 (use-after-free leading to remote code execution), which affect PHP 8.2 below 8.2.35. Reported and documented by rdz-oss in [BattyBirdNET-Pi discussion #150](https://github.com/rdz-oss/BattyBirdNET-Pi/discussions/150). Update and restart the add-on to get the fixed image
+
 ## 2026.10.26.1 (26-10-2026)
 - Fix: WebUI service actions (System Controls buttons, "Restart services", the chart restart after saving settings) work again. Since 2026.07.10-1 the build stripped `sudo` from every BirdNET-Pi script, so these ran `systemctl` as php-fpm's `caddy` user: the service-control buttons no longer matched the WebUI's allow-list (which still expects `sudo systemctl ...`) and were ignored, and the `systemctl` replacement looked for the running services in `/tmp/run` instead of root's `/run`, so it could neither see nor stop them. It also turned `sudo -u <user> ...` into a bare `-u <user> ...` in `config.php` (species list, test notification). `sudo` is kept again; `caddy` and `pi` already have passwordless sudo in the image
 

birdnet-pi/Dockerfile

@@ -116,6 +116,10 @@ RUN \
     # Ensure always pi is used
     grep -srl "/etc/passwd" "$HOME/BirdNET-Pi/" | while IFS= read -r file; do sed -i "s=/etc/passwd=/etc/passwd | head -1=g" "$file"; done && \
     \
+    # Patch PHP (CVE-2026-109618/109619): pull the Debian-patched php packages
+    apt-get install -y --only-upgrade '^php.*' && \
+    dpkg --compare-versions "$(dpkg-query -W -f='${Version}' php8.2-fpm)" ge 8.2.35 && \
+    \
     # Cleanup
     apt-get clean all && \
     rm -rf /var/lib/apt/lists/*

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.10.26.1
+version: "2026.10.31"
 video: true