Is PHP2Shell fixed on Docker Official Images: php?

Status as of October 26, 2026: Partly confirmed: some builds are confirmed in two primary sources, others aren’t yet.

The short answer

Docker Official Images: php ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: Maintained tags: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (cli, apache, fpm and zts variants) (docker-library official-images and versions files). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Docker php images

• PHP 8.1 and older: no official image is maintained, so there’s no fixed image for those branches.

How to check on Docker php images (read-only)

Run these where your containers run. They only read container and image metadata, and run read-only PHP one-liners inside the container.

# 1. Running containers, their images, and how long they've been up
docker ps --format '{{.ID}}  {{.Image}}  {{.RunningFor}}'

# 2. The PHP version inside a container: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on its branch
docker exec <container> php -r 'echo PHP_VERSION, PHP_EOL;'

# 3. When was the image built? The running container must come from an image built after the fix
docker image inspect <image> --format '{{.Created}}'

# 4. CVE-2026-115560: the value PHP sees inside the container ("0" means off)
# This reads the command-line PHP; a PHP-FPM pool's php_admin_value can differ, so check the pool files too
docker exec <container> php -r 'var_dump(ini_get("session.upload_progress.enabled"));'

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Docker php images: The image files don’t mention CVE-2026-115560. PHP’s recommended setting must go into the image’s configuration (for example an ini file in the image’s conf.d directory), followed by a rebuild and redeploy.

Notes for Docker php images

• The official image builds PHP’s own releases, so its version number is meaningful: a container on 8.4.27 or later has the fix for that branch (source: php.net release archive). But only if the running container was recreated from a newly pulled image. Pulling alone changes nothing that’s already running.
• 8.6.0RC4 is a release candidate. Don’t use it in production for this fix.

Sources (checked October 26, 2026)

• Docker Official Images (docker-library): library/php. Page date: no date in file. States: Tags 8.5.12, 8.4.27, 8.3.36, 8.2.35 (cli, apache, fpm, zts; trixie, bookworm, alpine3.24, alpine3.23); 8.6.0RC4; nothing for 8.1 or older.
• Docker Official Images (docker-library/php): versions.json. Page date: no date in file. States: 8.2: 8.2.35; 8.3: 8.3.36; 8.4: 8.4.27; 8.5: 8.5.12; 8.6-rc: 8.6.0RC4.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Debian 13 (trixie) · Debian 12 (bookworm) · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.