nicolabeghin/php repository overview

⁠php — PHP 7.4 + Apache, patched for CVE-2026-109618 / CVE-2026-109619

An unofficial rebuild of the discontinued php:7.4-apache image, compiled from the upstream php-src fix branch instead of the 7.4.33 release.

PHP 7.4 has been end-of-life since November 2022, and the official Docker image was removed from Docker Hub's build pipeline. PHP's security team has published a minimal mitigation for 7.4 on the branch PHP-7.4-CVE-2026-109618-109619⁠. This image is built from exactly that commit, so legacy 7.4 applications can get the fix without migrating first.

⁠Tags

The tag is pinned to one commit. It will not move unless the fix is rebuilt on purpose.

⁠What it is

• Drop-in replacement for php:7.4-apache: same configure flags, same extension list, same helper scripts (docker-php-ext-install, docker-php-ext-enable, docker-php-source, apache2-foreground), same /usr/local/etc/php layout.
• Based on the last official docker-library Dockerfile for 7.4/bullseye/apache (docker-library/php commit b9f17156), with these changes:
  • PHP source is the pinned php-src commit (verified by SHA-256 at build time) instead of the release tarball. Git snapshots ship no configure, so the build runs buildconf (adds bison).
  • No GPG check: the branch has no signed release tarball.
  • Debian apt sources pinned to snapshot.debian.org (main) and archive.debian.org (security), because bullseye is EOL and the default mirrors are unreliable.
• Contains no application code and no secrets.

⁠Usage

FROM nicolabeghin/php:7.4-apache-cve-2026-109618

RUN docker-php-ext-install mysqli pdo_mysql
COPY . /var/www/html/

docker run -d -p 8080:80 -v "$PWD":/var/www/html nicolabeghin/php:7.4-apache-cve-2026-109618

⁠Important caveats

• Not an official PHP release. It is a build of an unreleased fix branch of an EOL version. It has not been through the PHP release process, and I have not run the full php-src test suite against it. Test your application before relying on it.
• Mitigation, not a full audit. The upstream commit calls itself a "minimal mitigation for EOL version". PHP 7.4 still receives no other security fixes, and the Debian bullseye base is EOL too.
• Defence in depth. Until you can move to a supported PHP release, also apply the workarounds from the php.net advisory⁠ (e.g. session.upload_progress.enabled=0, bounded post_max_size, a container memory limit if you set memory_limit=-1).
• The image is rebuilt on request, not on a schedule. Check for an official PHP 7.4 release or newer branch before depending on it long term.
• The best fix is to upgrade to a supported PHP version.

⁠Maintenance and source

Provided as is, with no warranty. PHP is distributed under the PHP License⁠; this image is not affiliated with or endorsed by The PHP Group or Docker, Inc.