Two security events landed side by side this week: PHP2Shell and the eMudhra certificate compromise. Both reach the same place — the foundation applications are built on, rather than the application code itself. Docker's response addresses both at the image layer.
PHP2Shell is a pair of critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. They let an unauthenticated request become code execution on the server, affecting any PHP application regardless of how carefully its own code is written. PHP runs roughly 69% of websites whose server-side language is known, so the blast radius is large. The eMudhra issue is a different class of problem: eight intermediate certificates from the certificate authority were found to have private keys computable from the public certificates, which lets anyone issue a certificate for any website and have it accepted.
Browsers revoke certificates like these on their own, but a container image carries its own trust store and keeps trusting them until it is rebuilt.
- Docker Hardened Images published a fixed PHP image within 24 hours: the
dhi.io/phpimage was rebuilt on the patched PHP and published early on October 22, within a day of the upstream release. - The rebuild followed the DHI testing and verification steps before publication.
- Pulling the current tag moves you onto the patched build, refreshing the image's bundled trust store along with the engine fix.
For developers, the takeaway is that patching application code is not enough when the vulnerability sits in the runtime or the trust anchors baked into your base image. Pulling the current dhi.io/php tag is a fast way to pick up both fixes without waiting on your own rebuild pipeline.
Source: https://www.docker.com/blog/php2shell-and-emudhra-patched/