Reviewed 2026-11-04. E-Invoice Validator supports these patched PHP branches:

Composer excludes earlier versions. A Composer bootstrap also checks the actual interpreter, covering copied vendor directories or overridden Composer platform settings. Standalone CLI use applies the same check. Unreviewed branches fail. This guard does not patch PHP or protect request parsing before application code.

The Docker runtime is PHP 8.4.27 CLI, pinned by digest. Its build runs tools/check-runtime.php, failing for unsupported PHP or enabled session upload progress. make check-runtime checks the current interpreter/startup settings. make test requires that check; use make test-container on an older host.

• CVE-2026-109618 / CVE-2026-109619 (PHP2Shell): use the patched versions above. PHP advisory, OOM advisory, stale-state advisory.
• CVE-2026-115560: the follow-up session upload-progress issue is handled by setting session.upload_progress.enabled=0 before request parsing. It is included in docker/php-security.ini; PHP 8.4.27 alone is insufficient for this follow-up. PHP follow-up advisory.

For an application embedding this library, apply the INI setting to every actual FPM/Apache/other web runtime and restart/recreate its workers. Setting it using ini_set() in application code is too late. Verify the effective web SAPI, not only the CLI configuration. Do not treat Composer's config.platform.php or --ignore-platform-reqs as security fixes. Vendor backports below these version floors are conservatively rejected; use an accepted upstream version.

Windows deployments additionally need the updated -1 distribution packages for the Brotli dependency fix (CVE-2026-111497); PHP_VERSION is unchanged by that package rebuild. The provided Docker runtime is Linux. PHP Windows build notice.

Keep applying subsequent security updates. These checks address the named advisories and do not certify absence of other vulnerabilities. Library updates do not upgrade the developer host or a consuming application's PHP server.

The default runtime uses the pinned PHP 8.4.27 Debian 13 (trixie) image. Security updates are applied during the build and PHP compilation tools and headers are removed from the final runtime. This replaces the Debian 12 SQLite version affected by CVE-2025-7458 and reduces unused build-time components. Runtime source scans and full image scans remain separate checks.

Debian still lists CVE-2026-6653 in its stable libxml2 package. Invoice XML must be UTF-8 without NUL bytes and DTD/entity declarations are rejected before calling libxml, so prohibited DTD input does not reach its internal-subset parser. This is an application mitigation, not a claim that libxml itself was patched. Raw vulnerability reports must retain this finding until the distribution fixes it or an artifact-specific applicability assessment establishes non-exposure.

References: SQLite, libxml2, zlib/MiniZip applicability.