Docker began tracking two critical PHP vulnerabilities on Tuesday, October 20, 2026. Tracked as CVE-2026-109618 and CVE-2026-109619 and commonly called PHP2Shell, the flaws allow attackers to execute code remotely in PHP core. They affect PHP packages going back to version 5.4, including supported releases 8.2 through 8.5 and end-of-life branches 5.x, 7.x, 8.0 and 8.1. The vulnerability sits in PHP itself rather than in Docker's own systems, but it directly impacts anyone who builds on PHP images and packages.
To address the flaws, PHP released patched versions and advised everyone running PHP to upgrade immediately. Docker's response, as described in its security update:
- PHP issued 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixed releases.
- Docker updated Docker Hardened Images and Docker Official Images on Docker Hub to incorporate the fixes. See https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/ for the original announcement.
- Docker advises customers to update immediately.
- Docker states it is tracking the vulnerabilities alongside other package repositories and secure package providers that distribute the affected PHP packages.
Because these are remote code execution flaws in the PHP runtime, any container built on an unpatched base image inherits the exposure, regardless of application code. Developers should refresh their base images to the patched tags, rebuild dependents, and redeploy. Where possible, pin explicit fixed patch versions instead of floating tags so builds are reproducible and auditable. Also check any PHP packages pulled from other repositories or vendored into custom images, since the affected range stretches back to 5.4 and includes several end-of-life branches that will not receive upstream fixes. Running a quick scan against the two CVE identifiers will show which images and pipelines still need attention. For teams that build on PHP, treating this as a base-image supply chain issue rather than an application-level bug is the fastest route to remediation.
Source: https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/