Summary
On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back to version 5.4: the supported versions 8.2 through 8.5, and the end-of-life versions 5.x, 7.x, 8.0, and 8.1.
To address these vulnerabilities, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and advised anyone running PHP to update to the latest version immediately.
Although this is a vulnerability in PHP itself, not in Docker’s systems, it nonetheless affects Docker users who build on PHP images and packages. In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update.
What Happened
Along with other package repositories and secure package providers, Docker has been made aware of and is tracking two recently discovered critical vulnerabilities in PHP packages distributed since version 5.4. The two critical vulnerabilities, now commonly referred to as “PHP2Shell,” are identified and tracked as CVE-2026-109618 and CVE-2026-109619. (The PHP Foundation has published a detailed report on the discovery that we recommend reading for full context.)
In short: these vulnerabilities could allow remote code execution in PHP core by malicious actors. Both are flaws in how PHP manages request memory. In CVE-2026-109618, when PHP runs out of memory mid-request and aborts, some code paths leave memory uninitialized, and PHP’s cleanup step then reads it. In CVE-2026-109619, PHP’s internal state can keep pointing at memory that has already been freed, and a later request then uses that stale state. Attackers have multiple ways to trigger either condition and turn it into remote code execution.
Affected versions include the currently supported versions (8.2 through 8.5), as well as the EOL and unsupported versions 5.x, 7.x, 8.0, and 8.1.
Impact to Anyone Using PHP
Whether you are a Docker user or not, if you are using any of the above affected versions of PHP, you should immediately upgrade to the latest version. That includes PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in the corresponding branch.
There is no other comprehensive remediation for the affected versions. Updating is the only complete mitigation path.
If for any reason you are unable to complete an immediate update, we strongly recommend taking your system offline until such time that you can initiate mitigation. This the guidance of not only Docker, but of the FBI, and numerous experts throughout the cybersecurity community.
Impact to and Actions for Docker Users
While this vulnerability exists in PHP itself and not directly in Docker’s systems, there is nonetheless potential risk and exposure to Docker customers who run PHP in their applications, including anyone using PHP images or packages from Docker Hub, Docker Official Images, or Docker Hardened Images.
For users of Docker Official Images:
Docker Official Images have already been updated and released to Docker Hub and mirrored to Amazon ECR. Customers using either of these sources should update immediately.
For users of Docker Hardened Images (DHI):
Docker Hardened Images have already been updated and released to Docker Hub. The currently supported versions of PHP were updated as follows:
- 8.2.34 → 8.2.35
- 8.3.35 → 8.3.36
- 8.4.26 → 8.4.27
- 8.5.11 → 8.5.12
The updates to our images were completed and released within 24-hours of the upstream patches being made available. These images were made available after successfully executing the DHI testing and verification processes.
What’s next
If you have any issues accessing the updated images or migrating to the new versions, please contact Docker Support at app.docker.com/support/contact. As always when it comes to matters of security, we appreciate your diligence.
