On October 22, 2026, Docker issued a security update regarding two critical vulnerabilities known as PHP2Shell affecting PHP packages. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow remote code execution.
Vulnerability Details
Docker stated that it began tracking two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, on Tuesday, October 20, 2026. These flaws, commonly referred to as PHP2Shell, affect PHP packages going back to version 5.4.
According to Docker, the vulnerabilities can allow remote code execution in PHP core by malicious actors due to how PHP manages request memory. Affected versions include currently supported versions 8.2 through 8.5, as well as end-of-life versions 5.x, 7.x, 8.0, and 8.1.
Docker Image Updates
In response to the issue, Docker updated its Docker Hardened Images and Docker Official Images on Docker Hub. Docker noted that Docker Official Images have also been mirrored to Amazon ECR.
Docker Hardened Images were updated from version 8.2.34 to 8.2.35, 8.3.35 to 8.3.36, 8.4.26 to 8.4.27, and 8.5.11 to 8.5.12. Docker stated these updates were completed and released within 24 hours of upstream patches becoming available.
Recommended Remediation
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities. Docker advised anyone running PHP to update immediately, noting that updating is the only complete mitigation path.
If users are unable to complete an immediate update, Docker recommended taking the system offline until mitigation can be initiated, citing guidance from the FBI and cybersecurity experts.
What to do
- Upgrade to the latest PHP version immediately, such as 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a later release in the corresponding branch.
- Update Docker Official Images or Docker Hardened Images if you use PHP images or packages from Docker Hub or Amazon ECR.
- If unable to complete an immediate update, take your system offline until mitigation can be initiated.
Key facts and where they come from
- Docker began tracking two critical PHP vulnerabilities known as PHP2Shell on October 20, 2026.
On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell.
- PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the vulnerabilities.
PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and advised anyone running PHP to update to the latest version immediately.
- Docker Official Images were updated and released to Docker Hub and mirrored to Amazon ECR.
Docker Official Images have already been updated and released to Docker Hub and mirrored to Amazon ECR.
- Docker Hardened Images were updated and released to Docker Hub.
Docker Hardened Images have already been updated and released to Docker Hub.
