Two security events landed side by side this week, PHP2Shell and the eMudhra certificate compromise. Both reached the same place, the foundation their applications are built on. PHP2Shell is a pair of critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. They let an unauthenticated request become code execution on the server, on any PHP application, however careful its own code is, and PHP runs about 69% of the websites whose server-side language is known. The eMudhra compromise is a different kind of problem. Eight intermediate certificates from the certificate authority eMudhra turned out to have private keys that can be computed from the public certificates, which let anyone issue a certificate for any website and have it accepted. Browsers revoke certificates like these on their own, but a container image carries its own trust store and keeps trusting them until it is rebuilt. Docker Hardened Images published a fixed PHP image within 24 hours
The dhi. io/php image was rebuilt on the patched PHP and published early on October 22, within 24 hours of the upstream release and after the DHI testing and verification steps. Pulling the current tag puts you on the fixed version. The few DHI images that bundle their own PHP application, such as composer and nextcloud, follow as their upstream projects release. Rebuilt across the catalog, verifiable tag by tag
The certificate compromise touched the whole catalog, because every image carries a trust store. In the 48 hours after the PHP release, the DHI build system ran 16,567 package and image builds across the catalog. By 10pm UTC on October 22, almost all catalog tags were on the fixed CA store, with most of the rest in the build queue. That percentage comes from the SBOM that ships with every image, read for every published tag to check which CA store and which PHP version it carries, and you can run the same check on anything you pull…
