Critical Severity
CVE-2026-109618
Published: Nov 6, 2026
PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.
# PHP 7.4.33 security backports for Docker
A source-built PHP 7.4 CLI/FPM image for investigating, testing and migrating legacy applications.
The repository keeps the runtime work visible: pinned PHP sources, ordered backports, native dependency locks, build instructions and recorded test evidence. You can inspect the inputs, rebuild the image and compare behavior with your application.
> **UNVERIFIED development preview — production_ready=false.**
> PHP 7.4 is end of life, and detailed independent mysqlnd review remains unfinished. Backports do not restore official support or prove that every historical vulnerability has been resolved.
>
> **PHP OpenSSL is unavailable in this variant.** Native `openssl_*` functions and TLS/HTTPS stream wrappers are absent. HTTPS through cURL uses the pinned native TLS provider. mysqlnd TLS and OpenSSL-dependent authentication are limited; do not replace verification with an insecure fallback.
[Docker Hub](https://hub.docker.com/r/shellharbor/php-7.4-cve-2026-docker) · [Build workflow](https://github.com/shellharbor/php-7.4-cve-2026-docker/actions/workflows/build.yml) · [Security status](SECURITY.md) · [Historical evidence](docs/HISTORY.md)
## CVE-2026-109618 and CVE-2026-109619
This image includes targeted fixes for **CVE-2026-109618** and **CVE-2026-109619** through PHP's official minimal end-of-life backport for PHP 7.4.
| CVE | Upstream issue | Included implementation |
| --- | --- | --- |
| [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) | Request-state corruption during out-of-memory handling | Official minimal PHP 7.4 EOL backport |
| [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) | Reuse of stale request-owned global state after its memory is freed | Official minimal PHP 7.4 EOL backport |
The selected upstream commit is [712e60f9