tingao/php repository overview

⁠php:8.1-apache with the php2shell fix (CVE-2026-109618 / CVE-2026-109619)

Both CVEs are CVSS 9.2 unauthenticated RCE, exploitable in mod_php before any application code runs.

PHP 8.1 is end-of-life upstream, so the official php:8.1-apache image will never receive this patch. This image backports the fix from the PHP security team's branch PHP-8.1-CVE-2026-109618-109619 onto PHP 8.1.34 and otherwise behaves like upstream, including the apache2-foreground entrypoint and the usual apache SAPI.

⁠Use

docker run -d -p 8080:80 -v "$PWD":/var/www/html tingao/php:8.1-apache-cve-2026-109618-109619

As a base image:

FROM tingao/php:8.1-apache-cve-2026-109618-109619

⁠Verify

docker run --rm --entrypoint php tingao/php:8.1-apache-cve-2026-109618-109619 -v

Expected: PHP 8.1.34 built Oct 21 2026. Verified before publishing: the patched zend_mm_safe_error_ex symbol is present in the binary, SAPI=apache2handler was confirmed live over HTTP, and session.upload_progress.enabled=Off is set as defence in depth.

⁠What this is not

PHP 8.1 remains end-of-life. Only this one fix is backported. Every other issue present in the final official 8.1 release is still unfixed. Upgrade to a supported PHP version when you can.

For other EOL versions (7.x, 8.0, 8.1; cli/fpm/apache; Debian/Alpine; multi-arch) see https://github.com/mpyw/php-eol-CVE-2026-109618-109619⁠