Docker Updates PHP Official and Hardened Images to Mitigate PHP2Shell
Docker has updated its Official Images and Hardened Images on Docker Hub following two critical PHP memory-management vulnerabilities known as PHP2Shell.
Before you start: versions, package names and storage identifiers change over time. Check the commands against the official documentation for your setup before running them, especially anything that creates, deletes or overwrites data.
Docker has issued an urgent security notice regarding two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively known as PHP2Shell. The flaws affect PHP packages dating back to version 5.4, including currently supported branches 8.2 through 8.5 as well as end-of-life versions.
Discovered in how PHP manages request memory, the vulnerabilities can be exploited by malicious actors to achieve remote code execution in PHP core. CVE-2026-109618 triggers when PHP aborts mid-request due to memory exhaustion, leaving certain code paths with uninitialized memory that the cleanup phase reads. CVE-2026-109619 occurs when internal states point to already-freed memory, which subsequent requests can then leverage.
Action Required for Container Practitioners
While the flaws originate within PHP rather than Docker infrastructure, they directly impact developers building applications on PHP container images. Upgrading to the latest patched releases—versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, or later—is the only comprehensive remediation. Experts and security bodies warn that systems unable to undergo an immediate update should be taken offline.
Updates to Docker Hub and Hardened Images
Docker has responded by refreshing both Docker Official Images and Docker Hardened Images (DHI) on Docker Hub. Official Images have also been mirrored to Amazon ECR. The targeted updates bumped supported branches to remediate versions:
- PHP 8.2.34 updated to 8.2.35
- PHP 8.3.35 updated to 8.3.36
- PHP 8.4.26 updated to 8.4.27
- PHP 8.5.11 updated to 8.5.12
These image revisions rolled out within 24 hours of upstream patches becoming available, following standard testing and verification workflows. Practitioners encountering issues during migration or image access can reach out to Docker Support.
Source
Official announcement or documentation
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
