mCMS

mCMS 0.1.11 — PHP2Shell security hotfix

Security patch based on the published v0.1.10 source. No unrelated main development changes are included.

Security

• Update the official Docker application and updater runtime to PHP 8.4.27, fixing CVE-2026-109618 and CVE-2026-109619 (PHP2Shell).
• Make the Docker build fail when PHP is older than 8.4.27.
• The issue affects the PHP interpreter, not mCMS application logic. Standalone/shared-hosting installs also need their PHP runtime updated by the hosting provider or server administrator.

Compatibility and upgrade

• No schema changes, new required settings or interface changes compared to v0.1.10.
• Docker/Portainer: install ghcr.io/mirivlad/mcms-app:v0.1.11 and ghcr.io/mirivlad/mcms-web:v0.1.11, or re-pull :stable after the image-ready release asset is published. Preserve all existing data volumes; keep a backup before upgrading.
• Updater worker uses the same corrected application image.
• Shared hosting: the verified mcms-0.1.11-shared-hosting.zip package updates the mCMS application, not system PHP. Check the interpreter is patched (PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later).
• Verify php -r 'echo PHP_VERSION, "\\n";' inside the running app container and check the application after redeployment.

See the PHP security advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Открыть релиз на GitHub ↗

mCMS 0.1.10 — account redesign and standalone hosting documentation

Stable patch release for existing mCMS 0.1.x Docker/Portainer installations and shared-hosting sites. Includes all 0.1.9 features; no new database schema migrations are required for this release.

Changed

• Redesigned the user account dashboard: separate compact identity header, unified responsive workspace for profile and security, clearer buttons, removal of duplicate logout/navigation elements and invalid nested form markup.
• When the Orders service is enabled, the account dashboard shows the user's latest three orders and a direct link to the complete order history. Queries enforce the logged-in user's ID; no Orders tables are accessed if the module is disabled. Account and password forms retain CSRF, validation and existing server endpoints.
• Fixed mobile site header spacing when signed-in account links and the theme navigation compete for width.
• Added theme-independent responsive styling shared across all bundled themes and standalone layouts; account CSS URLs now include the Core version to prevent stale browser caches.
• Documented Nginx + PHP-FPM, Caddy + PHP-FPM, Apache without mod_rewrite, and LiteSpeed/OpenLiteSpeed in full Russian and English administrator guides. The web-server requirement is front-controller routing and protected private files, not Apache/mod_rewrite specifically. Media URLs must be forwarded to the PHP controller even though CSS/JS is served statically.

Upgrading & rollback

• Official standalone PHP installer package: mcms-0.1.10-shared-hosting.zip (includes Composer dependencies, frontend assets and both manuals). Check SHA256SUMS from the same GitHub Release; do not use GitHub's source ZIP as a shared-host installer.
• Docker: app/web images published as ghcr.io/mirivlad/mcms-app:v0.1.10, ghcr.io/mirivlad/mcms-web:v0.1.10 and :stable. An opt-in Core auto-updater on portainer-release-stack.yml may deploy this compatible patch release only when Portainer HTTPS API credentials, Stack/Endpoint IDs, MariaDB digest pin and MCMS_IMAGE_TAG=stable are correctly configured.
• Back up and download the full site ZIP before upgrading. Portainer auto-updates are not a guarantee of automatic rollback for image/database failures. Keep the previous release image/tag and archive until verification.
• Shared hosting: use the verified patch ZIP updater in /admin/updates. The existing webroot and rescue bootstrap files remain unchanged, allowing staged code swap/rollback.

Guides: Русский · English.

Открыть релиз на GitHub ↗

mCMS 0.1.9 — first public dual-deployment release

This release supports both Docker/Portainer deployments and conventional Apache/PHP/MySQL shared hosting without requiring Docker, SSH or Composer on the hosting account. It uses one Core/module/theme implementation for both modes.

Get started / Начало работы: English manual · Руководство на русском. The official release asset mcms-0.1.9-shared-hosting.zip includes all PHP dependencies, bundled frontend resources, both user manuals, and a browser-first MySQL installer. The standard Git Stack uses portainer-stack.yml; no Docker Hub mcms:dev image is needed.

Major additions

• Standalone installation with PHP/extensions/document-root preflight, MySQL credentials and initialization, optional SMTP, and a first-superadmin wizard.
• Apache/PHP Media delivery with strict filenames and private-directory isolation.
• PHP-only logical backups, database restore, module/theme updates and recovery procedures for hosts without shell utilities.
• Validated, manual same-minor patch Core ZIP upgrades for standalone, including a site backup, staged code swap and independent pre-bootstrap recovery logic.
• Russian and English user and administrator documentation: install, update, modules, themes, backup, restore, rollback, troubleshooting for both deployment modes.

Release safety notes

• Back up and download the ZIP off-server before updates; preserve compatible Core source/images and deployment configuration. Never remove production Docker volumes during redeploy.
• The backup schema is tied to the exact Core version. Standalone PHP database exports are not interchangeable with Docker's CLI SQL dumps through the web restore wizard.
• The Core ZIP updater is deliberately limited to patch releases in the current X.Y line, with the same bootstrap entry files. Other upgrades require supervised manual work. Automatic updates are off by default.
• PHP shared-hosting quotas, timeouts, storage permissions and SQL dialect differences can prevent large-site restores. Keep external backups and test recovery on a separate instance. Package hashes detect corruption but do not authenticate unknown third-party code.
• Docker Core auto-update through the Portainer API still does not guarantee automatic rollback of image and database migrations.

All artifacts are built from this tag and checksummed in SHA256SUMS. Do not install the GitHub-generated "Source code" ZIP on shared hosting: it does not include vendor dependencies or built UI assets.

Открыть релиз на GitHub ↗