PHP2Shell: Docker updates Official and Hardened images for two RCE

Docker has updated the Docker Official Images and Docker Hardened Images (DHI) on Docker Hub following the disclosure of two critical PHP vulnerabilities known as PHP2Shell. This affects anyone building containers from official or hardened PHP images: if the tag used in your Dockerfile points to an earlier build, your production container remains exposed to unauthenticated remote code execution.

What happened

On Tuesday, 20 October 2026, Docker began tracking two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. In summary: these vulnerabilities can allow remote code execution in the PHP core, with both flaws related to memory handling during request processing. In CVE-2026-109618, when PHP runs out of memory mid-request and interrupts execution, certain code paths leave uninitialized memory that is then read during cleanup; in CVE-2026-109619, PHP's internal state can continue pointing to already-freed memory, and a subsequent request uses that stale state.

On the timeline front, an independent technical analysis (containersecurity.dev) reports that the upstream PHP patch was released on 21 October at 14:00 UTC, Official Images were rebuilt and published between 15:48 and 16:05 UTC on the same day, whilst Docker Hardened Images were rebuilt between 03:12 and 07:38 UTC on 22 October.

Affected versions

The Docker Hardened Images have already been updated and released on Docker Hub, with currently supported PHP versions updated as follows:

Branch	From	To
8.2	8.2.34	8.2.35
8.3	8.3.35	8.3.36
8.4	8.4.26	8.4.27
8.5	8.5.11	8.5.12

Docker notes that updates to its images were completed within 24 hours of upstream patch availability, following DHI verification testing.

What to do

Those using images based on now end-of-life branches (5.x, 7.x, 8.0, 8.1) will not find a numbered patch on Docker Hub: for those branches, migration to a supported branch is the only option. To verify whether an already-built image still contains the CVEs, you can run docker scout cves --only-cve-id CVE-2026-109618,CVE-2026-109619 image-name:tag. To pin the correct version and prevent a tag from being overwritten, it's advisable to lock in the immutable digest with docker buildx imagetools inspect php:8.5.12-fpm --format '{{.Manifest.Digest}}' and use it in the FROM statement instead of the floating tag.

If you experience any issues accessing the updated images, Docker recommends contacting support via the form at app.docker.com/support/contact.