Revision: 1.0
--------------------------------------------------------------------------------
Package            fix-php2shell.cbsa
                   fix-php2shell-offline.cbsa (Evolution Box without internet)

Version            any, the installed version does not change

Required version   any

Support models     Evolution Box with Ubuntu 22.04, 24.04 or 20.04

--------------------------------------------------------------------------------
WHAT THIS PACKAGE DOES

 It upgrades PHP to the version that fixes php2shell (CVE-2026-109618 and
 CVE-2026-109619), two critical vulnerabilities that let anyone who reaches
 the web of the Evolution Box run code on it, without a user or password.

 Only the PHP packages already installed are upgraded, with their
 configuration. Then the web server is restarted, so it runs the fixed PHP.

--------------------------------------------------------------------------------
NOTES

 The web is unavailable for a few seconds while the web server restarts.
 The Evolution Box doesn't need to reboot.

 fix-php2shell.cbsa downloads PHP from Ubuntu, so it needs internet.
 fix-php2shell-offline.cbsa carries it and needs no internet.

 Ubuntu 20.04 needs fix-php2shell-offline.cbsa: its php7.4 is not in any
 Ubuntu repository (we build it), so fix-php2shell.cbsa does not fix a 20.04
 box and says so.

--------------------------------------------------------------------------------
LIMITATIONS

 Ubuntu 14.04 (evo4) is not supported yet: on it the package changes nothing
 and says so.