Docker PHP images must be refreshed after critical PHP2Shell vulnerability patches

The Docker ecosystem now hosts patched PHP images that include the upstream releases fixing the PHP2Shell bugs (CVE‑2026‑109618, CVE‑2026‑109619). The updates were rolled out within 24 hours of the PHP project publishing version 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and Docker recommends that every user pull the new tags without delay.

What changed in Docker images

Docker Official Images and Docker Hardened Images (DHI) have been rebuilt to reference the patched PHP binaries. The version mapping for the Hardened line is:

• 8.2.34 → 8.2.35
• 8.3.35 → 8.3.36
• 8.4.26 → 8.4.27
• 8.5.11 → 8.5.12

Both the Official and Hardened repositories on Docker Hub (mirrored to Amazon ECR) now serve these newer tags. The images passed Docker’s DHI testing and verification before being published.

Why the PHP2Shell vulnerability matters to engineers

PHP2Shell is a set of two memory‑handling flaws in the PHP core that can be triggered to achieve remote code execution. The bugs affect every PHP release from 5.4 onward, including the currently supported 8.2‑8.5 series and the end‑of‑life 5.x, 7.x, 8.0, and 8.1 branches. Any container that runs a vulnerable PHP binary—whether built from an Official Image, a Hardened Image, or a custom base—exposes the host and downstream services to arbitrary code execution.

AI engineers, platform engineers, DevOps/SRE teams, and security engineers all rely on Docker images for reproducible environments, CI/CD pipelines, and production services. A compromised PHP runtime can undermine model serving, API endpoints, or internal tooling, making the vulnerability directly relevant to those roles.

Operational and security implications

Because the flaw resides in PHP itself, the primary mitigation is to run a patched binary. Docker’s image updates provide a convenient path, but teams must verify that their build and deployment pipelines reference the new tags. If an immediate upgrade is not possible, the Docker advisory advises taking the affected systems offline until the patch can be applied—a recommendation echoed by the FBI and other security experts.

Practically, this means:

1. Updating Dockerfiles to use the latest php:8.x or php:-dh tags.
2. Re‑building images and redeploying services to replace any containers still running pre‑patch versions.
3. Running a quick version check (e.g., php -v) in running containers to confirm the patch level.
4. Monitoring Docker Hub for any follow‑up releases or hot‑fixes.

Because the vulnerability is not limited to a specific configuration, there is no partial mitigation; the only complete fix is the version upgrade.

Related CloudNinjas coverage: hands-on guides.

What This Means For Practitioners

Action items for teams using PHP in Docker:

• Pull the latest Official or Hardened PHP images immediately.
• Replace any pinned older tags in CI/CD pipelines with the new versions.
• Validate that applications start correctly with the upgraded runtime; address any compatibility regressions before promoting to production.
• If you cannot upgrade today, isolate the affected containers from the network and schedule a rapid outage window.
• Keep an eye on Docker’s support channel for any issues accessing the refreshed images.

By treating the PHP2Shell patches as a mandatory upgrade, engineering teams can maintain the security posture of their containerized workloads without introducing unnecessary downtime.