Docker Updates PHP Official and Hardened Images After the PHP2Shell Flaws, Moving the Four Supported Branches to 8.2.35, 8.3.36, 8.4.27 and 8.5.12
Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.
Overview
Docker published a security update on October 22, 2026, saying it has refreshed its PHP container images after the two critical PHP flaws that the post calls “PHP2Shell.” According to Docker, the company “updated the Docker Hardened Images and Docker Official Images on Docker Hub” and advises customers to update immediately. The underlying fixes were covered in The Machine Herald’s report on the PHP security release; this article covers what changed for container users.
What We Know
- The vulnerabilities. Docker says it began tracking CVE-2026-109618 and CVE-2026-109619 on Tuesday, October 20, 2026. Docker describes both as flaws in how PHP manages request memory that could allow remote code execution in PHP core, and says the flaw is “in PHP itself, not in Docker’s systems.”
- Official Images. Docker says they “have already been updated and released to Docker Hub and mirrored to Amazon ECR.” In the docker-library repository, a pull request titled “[security] Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35” was opened by the user jnoordsij and merged on October 21, 2026.
- Hardened Images. Docker lists four version moves for the currently supported PHP branches: 8.2.34 to 8.2.35, 8.3.35 to 8.3.36, 8.4.26 to 8.4.27 and 8.5.11 to 8.5.12. It says the updates “were completed and released within 24-hours of the upstream patches being made available” after the Docker Hardened Images testing and verification processes.
- Fixed versions upstream. The PHP.net notice dated October 21 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 “fix two critical vulnerabilities that can allow unauthenticated remote code execution.”
Guidance for Users
Docker’s post tells anyone running affected PHP versions to upgrade to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a later release in the same branch. It states that “Updating is the only complete mitigation path.” For operators who cannot update at once, Docker says it strongly recommends taking systems offline until mitigation can begin, and attributes that guidance to the FBI and other cybersecurity experts as well as to itself.
A Follow-Up Advisory From PHP
On October 23, PHP.net published an informational advisory suggesting that users set session.upload_progress.enabled=0 until the next regular bugfix release, “to fully protect from an unlikely RCE vector.” The notice says the issue can occur only under “an unusual combination of configuration and application code” and that a full advisory for CVE-2026-115560 will be published with the next release. Docker’s post, dated a day earlier, does not mention CVE-2026-115560.
What We Don’t Know
- Docker’s post says the vulnerable versions include end-of-life branches 5.x, 7.x, 8.0 and 8.1, but its list of image updates covers only the currently supported 8.2 through 8.5 branches. PHP.net says PHP 8.1 and older “no longer receive updates from the PHP project.” The sources reviewed do not say whether Docker will publish images for those branches.
- The sources do not say whether either flaw has been exploited against container workloads.
- Docker’s post does not say how its images relate to the CVE-2026-115560 session upload progress setting that PHP.net flagged on October 23.