cc-ci/testme cc-ci: success
PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and CVE-2026-109619. The real fix is the rebuilt official image on PHP 8.3.36; this disables the confirmed session upload-progress exploit path as defence in depth and bumps the version so operators redeploy and re-pull the image.