Security Update on PHP2Shell: Impact for Docker Customers

T1Covered by 1 source · first reported by Docker / HashiCorp / Grafana / Datadog / Honeycomb / Fly.io at 22 Oct, 17:22 UTC

On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell.

security

Sources

• T1Security Update on PHP2Shell: Impact for Docker CustomersDocker / HashiCorp / Grafana / Datadog / Honeycomb / Fly.io22 Oct, 17:22

Vulnerabilities

• CVE-2026-109618
• CVE-2026-109619