Docker images of end-of-life PHP 7.0 to 8.1 with the fix for CVE-2026-109618 and CVE-2026-109619.
The official php images on Docker Hub only cover 8.2 and later.
These images fill the gap for older versions.
Warning
These versions are still end-of-life. Only this one fix is backported. Other known issues after the last official release stay unfixed. Plan your upgrade to a supported PHP version.
Caution
The fix for 7.0 to 7.3 is an unofficial backport. php-src publishes the fix only for 7.4, 8.0 and 8.1. This repository ports the 7.4 fix to 7.0, 7.1, 7.2 and 7.3 by hand. Nobody from the PHP project has reviewed these ports. No public proof of concept exists, so the ports are only tested indirectly. See Unofficial backports.
ghcr.io/mpyw/php-eol-cve-2026-109618-109619:<tag>
Platforms: linux/amd64, linux/arm64.
| PHP | Debian | Alpine | Variants |
|---|---|---|---|
| 7.0.33 | stretch | alpine3.7 | cli, fpm, apache (Debian only) |
| 7.1.33 | buster | alpine3.10 | cli, fpm, apache (Debian only) |
| 7.2.34 | buster | alpine3.12 | cli, fpm, apache (Debian only) |
| 7.3.33 | bullseye | alpine3.15 | cli, fpm, apache (Debian only) |
| 7.4.33 | bullseye | alpine3.16 | cli, fpm, apache (Debian only) |
| 8.0.30 | bullseye | alpine3.16 | cli, fpm, apache (Debian only) |
| 8.1.34 | trixie, bookworm | alpine3.22 | cli, fpm, apache (Debian only) |
Tags follow the official image naming.
| Tag example | Meaning |
|---|---|
7.4, 7.4.33 |
cli on the default Debian |
7.4-fpm, 7.4-apache |
that variant on the default Debian |
7.4-fpm-bullseye |
that variant on that OS |
7.4-alpine, 7.4-fpm-alpine |
cli or fpm on Alpine |
8.1-cli-bookworm |
8.1 on the non-default Debian |
The default Debian for each version:
| PHP | Default Debian |
|---|---|
| 7.0 | stretch |
| 7.1, 7.2 | buster |
| 7.3, 7.4, 8.0 | bullseye |
| 8.1 | trixie |
Each release also gets an immutable tag, such as 7.4.33-cli-bullseye-v1.0.0.
The releases list these tags with their digests.
Note
7.0 to 8.0 stay on the OS versions that docker-library used last. These PHP versions do not support OpenSSL 3, and newer OS releases ship only OpenSSL 3. All of these base images are past their own end of life. The Debian ones install packages from archive.debian.org.
Each Dockerfile is the last upstream docker-library/php Dockerfile for that variant. The build changes only the source step.
- Download the official tarball from php.net.
- Verify it with SHA-256 and the release manager GPG keys, as upstream does.
- Apply the fix from
patches/. - Repack the tarball, so
docker-php-source extractalso gives patched sources.
For 7.4 to 8.1, the patches come from these php-src branches:
| Patch | php-src branch | Commit |
|---|---|---|
7.4-CVE-2026-109618-109619.patch |
PHP-7.4-CVE-2026-109618-109619 |
712e60f9ed |
8.0-CVE-2026-109618-109619.patch |
PHP-8.0-CVE-2026-109618-109619 |
82f8f31b16 |
8.1-CVE-2026-109618-109619.patch |
PHP-8.1-CVE-2026-109618-109619 |
1d7dec178a |
For 7.0 to 7.3, the patches are unofficial backports. See Unofficial backports.
The PHP_VERSION string is not changed.
php -v shows the original version.
Use the image tag to tell patched images apart.
Note
8.1 on Alpine also needs the upstream fix for GH-14834.
Without it, --with-pear fails to install with the libxml2 in Alpine 3.22.
Upstream docker-library applies php/php-src@67259e451d for this.
That commit does not apply to 8.1.34 as is.
8.1.34 wraps the changed line in ZEND_DIAGNOSTIC_IGNORED_START / END.
patches/8.1-gh14834-rebased.patch is the same change, rebased onto 8.1.34.
The NEWS hunk is dropped, as upstream does.
The upstream fix calls itself a minimal mitigation for EOL versions. It changes some behavior on purpose.
| Change | Effect |
|---|---|
| Out of memory and allocation overflow errors | The process prints the fatal error to stderr and exits with code 1 at once. Shutdown functions do not run. Under FPM the worker restarts. |
| Session upload progress | Disabled. session.upload_progress.* has no effect. |
New INI max_multipart_body_parts |
Limits the parts in one multipart/form-data body. The default -1 means max_input_vars + max_file_uploads. |
| Multipart part headers | Only Content-Disposition and Content-Type are kept. Duplicates are ignored. |
The 7.0 to 7.3 patches port the php-src 7.4 fix (712e60f9ed) by meaning, not by fuzzy patching.
- Every change in the 7.4 fix is either ported, or left out because that code does not exist in the older version.
- Code that the older versions lack is added. This covers
ZSTR_MAX_LEN, the concat overflow checks andzend_new_array_singleton(). zend_vm_execute.his regenerated fromzend_vm_def.hwith each version's ownzend_vm_gen.php.shutdown_executor()differs a lot between versions. The state resets are placed where each version needs them.
Each port was checked against a build of the unpatched tarball, using these php-src test suites:
Zend/teststestsext/session/testsext/standard/tests/arrayext/standard/tests/strings
| Result | Details |
|---|---|
| New failures | 9 per version, all expected: 8 ext/session/tests/rfc1867* tests (upload progress is disabled), and tests/lang/bug45392.phpt (the fatal error now goes to stderr) |
| Same in upstream 7.4 | The same 9 tests fail on the image built from the official 7.4 fix |
| Out of memory | Each image exits with code 1 and skips shutdown functions |
| Multipart limit | max_multipart_body_parts limits the parts and emits a warning |
| Nested GPC arrays | Parse as before |
Warning
These checks show that the mitigation is in place and that nothing else broke. They cannot prove that the vulnerabilities are closed.
The Dockerfiles read the patches from a named build context.
docker buildx build --build-context patches=./patches -t php-eol:7.4-cli 7.4/bullseye/cliThe Dockerfiles and scripts are MIT, as in docker-library/php. See LICENSE.
The files in patches/ come from php-src, or are derived from php-src code.
They use the PHP License 3.01.