Summary
On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 , commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back to version 5. 4: the supported versions 8. 2 through 8. 5, and the end-of-life versions 5. x, 7. x, 8. 0, and 8. 1. To address these vulnerabilities, PHP released 8. 5. 12, 8. 4. 27, 8. 3. 36, and 8. 2. 35, and advised anyone running PHP to update to the latest version immediately . Although this is a vulnerability in PHP itself, not in Docker’s systems, it nonetheless affects Docker users who build on PHP images and packages. In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update. What Happened
Along with other package repositories and secure package providers, Docker has been made aware of and is tracking two recently discovered critical vulnerabilities in PHP packages distributed since version 5. 4. The two critical vulnerabilities, now commonly referred to as “PHP2Shell,” are identified and tracked as CVE-2026-109618 and CVE-2026-109619. (The PHP Foundation has published a detailed report on the discovery that we recommend reading for full context.) In short: these vulnerabilities could allow remote code execution in PHP core by malicious actors. Both are flaws in how PHP manages request memory. In CVE-2026-109618, when PHP runs out of memory mid-request and aborts, some code paths leave memory uninitialized, and PHP’s cleanup step then reads it. In CVE-2026-109619, PHP’s internal state can keep pointing at memory that has already been freed, and a later request then uses that stale state. Attackers have multiple ways to trigger either condition and turn it into remote code execution. Affected versions include the currently supported versions (8. 2 through 8…
