Security Update on PHP2Shell: Impact for Docker Customers

{
  "id": "716ce43b03322caeb3d3e2aba704c196b762915a9bf26209ef439ec2fe80c87a",
  "url": "https://www.docker.com/blog/security-update-on-php2shell-impact-for-docker-customers/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Security Update on PHP2Shell: Impact for Docker Customers",
    "summary": "Docker updated its Docker Official Images and Docker Hardened Images to include patched PHP versions for two PHP vulnerabilities. Docker advises customers using affected PHP versions or images to update immediately.",
    "evidence": "In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update.",
    "products": [
      {
        "name": {
          "value": "PHP",
          "evidence": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "8.5.12",
            "evidence": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35"
          },
          {
            "value": "8.4.27",
            "evidence": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35"
          },
          {
            "value": "8.3.36",
            "evidence": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35"
          },
          {
            "value": "8.2.35",
            "evidence": "PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35"
          }
        ],
        "affected_versions": [
          {
            "value": "5.4",
            "evidence": "PHP packages going back to version 5.4"
          },
          {
            "value": "8.2 through 8.5",
            "evidence": "the supported versions 8.2 through 8.5"
          },
          {
            "value": "5.x, 7.x, 8.0, and 8.1",
            "evidence": "the end-of-life versions 5.x, 7.x, 8.0, and 8.1"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-109618",
        "evidence": "identified and tracked as CVE-2026-109618 and CVE-2026-109619"
      },
      {
        "value": "CVE-2026-109619",
        "evidence": "identified and tracked as CVE-2026-109618 and CVE-2026-109619"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-docker-blog",
  "document_id": 23442,
  "published_at": "2026-10-22T17:22:47+00:00"
}