Add security measures to block PHP execution in storage directory

[jaydrogers]

Background

In July 2025, there was a 9.2 CVE disclosed for Laravel Livewire that allowed unauthenticated attackers to achieve remote command execution in specific scenarios.

How this exploit was used in the wild

One of our community members (@xaimes) noticed in some scenarios, attackers were using the vulnerability to preform further code execution by executing PHP scripts from the Laravel /storage directory.

How this applies to serversideup/php

Although the exploit was not from the serversideup/php image itself, we're using this as an opportunity to further harden our images to protect the community.

What this PR does

This PR prevents any .php file from being executed that is found in the /storage/* path.

For example, if someone visits:

https://example.com/storage/nested/in/some/deep/path/exploit.php

A 403 Forbidden message will be returned.

Note

This rule applies regardless if you're using Laravel or not. We felt this is a general enough of a directory name it is safe to apply to all PHP application types.

Variations this affects

This rule applies to:

1. FrankenPHP
2. FPM-NGINX
3. FPM-Apache