High Severity
CVE-2026-109618
Published: Oct 25, 2026
PHP 7.4 / 8.0 / 8.1 Docker images with the CVE-2026-109618 / CVE-2026-109619 fix backported
# php-eol-CVE-2026-109618-109619
Docker images of end-of-life PHP 7.0 to 8.1 with the fix for CVE-2026-109618 and CVE-2026-109619.
The official [`php`](https://hub.docker.com/_/php) images on Docker Hub only cover 8.2 and later.
These images fill the gap for older versions.
> [!WARNING]
> These versions are still end-of-life.
> Only this one fix is backported.
> Other known issues after the last official release stay unfixed.
> Plan your upgrade to a supported PHP version.
> [!CAUTION]
> **The fix for 7.0 to 7.3 is an unofficial backport.**
> php-src publishes the fix only for 7.4, 8.0 and 8.1.
> This repository ports the 7.4 fix to 7.0, 7.1, 7.2 and 7.3 by hand.
> Nobody from the PHP project has reviewed these ports.
> No public proof of concept exists, so the ports are only tested indirectly.
> See [Unofficial backports](#unofficial-backports-70-to-73).
## Images
```
ghcr.io/mpyw/php-eol-cve-2026-109618-109619:<tag>
```
Platforms: `linux/amd64`, `linux/arm64`.
| PHP | Debian | Alpine | Variants |
| --- | --- | --- | --- |
| 7.0.33 | stretch | alpine3.7 | cli, fpm, apache (Debian only) |
| 7.1.33 | buster | alpine3.10 | cli, fpm, apache (Debian only) |
| 7.2.34 | buster | alpine3.12 | cli, fpm, apache (Debian only) |
| 7.3.33 | bullseye | alpine3.15 | cli, fpm, apache (Debian only) |
| 7.4.33 | bullseye | alpine3.16 | cli, fpm, apache (Debian only) |
| 8.0.30 | bullseye | alpine3.16 | cli, fpm, apache (Debian only) |
| 8.1.34 | trixie, bookworm | alpine3.22 | cli, fpm, apache (Debian only) |
Tags follow the official image naming.
| Tag example | Meaning |
| --- | --- |
| `7.4`, `7.4.33` | cli on the default Debian |
| `7.4-fpm`, `7.4-apache` | that variant on the default Debian |
| `7.4-fpm-bullseye` | that variant on that OS |
| `7.4-alpine`, `7.4-fpm-alpine` | cli or fpm on Alpine |
| `8.1-cli-bookworm` | 8.1 on the non-default Debian |
The default Debian for each version:
| PHP | Default Debian |
| --- | --- |
| 7.0 | stretch |
| 7.1, 7.2 | buster |