shellharbor/php-7.4-cve-2026-docker repository overview

⁠PHP 7.4.33 — Security Backports for Docker

PHP CLI/FPM with targeted fixes for CVE-2026-109618 and CVE-2026-109619, pinned dependencies and inspectable build evidence.

Legacy applications still need maintenance while their migration is underway. This project provides a source-built PHP 7.4 runtime with documented security backports, updated native libraries and a transparent build process.

The source, patches, checksums, configuration and test evidence are available in the accompanying GitHub repository.

GitHub repository⁠ · v1.0.0 preview release⁠ · Security status⁠

⁠Targeted CVE fixes

This image includes PHP’s official minimal end-of-life backport for CVE-2026-109618 and CVE-2026-109619, pinned to upstream commit 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2⁠.

The upstream commit explicitly identifies both CVE fixes and describes its scope as a minimal mitigation for an EOL version. This build preserves that implementation and verifies the patch checksum during source preparation.

The EOL implementation has deliberate operational consequences: affected allocation failures terminate the worker immediately, without ordinary PHP shutdown callbacks, and session upload progress is disabled in source and configuration.

See the PHP security announcement⁠ and repository patch provenance⁠.

These targeted fixes do not establish complete historical CVE coverage or restore official PHP 7.4 support.

⁠What’s included

• PHP 7.4.33 CLI and PHP-FPM, built from a checksum-pinned official source archive.
• Ordered historical security backports, with recorded provenance and source verification.
• Updated native libraries: cURL 8.23.0, libxml2 2.15.4, SQLite 3.54.1 and OpenSSL 3.5.9 for native cURL TLS.
• Patched OpenLDAP and signed Debian external PCRE2 inputs.
• Common application extensions: mysqli, PDO MySQL/PostgreSQL/SQLite, mbstring, curl, GD, intl, zip, OPcache, bcmath, sockets, pcntl and exif.
• Non-root execution, read-only root filesystem support, a real FastCGI healthcheck and graceful shutdown.
• Build and scan evidence: source locks, patch checksums, runtime file hashes, Trivy reports and CycloneDX SBOM collection.

Compilers, Python and package managers are excluded from the final runtime image.

⁠Quick start

Published platform: Linux amd64.

docker pull shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified

Check the PHP version in an isolated container:

docker run --rm --platform linux/amd64 \
  --network none --read-only \
  --tmpfs /tmp:rw,nosuid,nodev,size=128m \
  --cap-drop ALL --security-opt no-new-privileges \
  --memory 512m --pids-limit 64 \
  shellharbor/php-7.4-cve-2026-docker:7.4.33-backport.3-fpm-unverified \
  php -v

Replace php -v with php -m to inspect the extension list.

Without a command override, the image starts PHP-FPM on FastCGI port 9000. Use a web server in front of FPM and keep that port private.

The repository includes a Nginx/FPM Compose example⁠, serving its demo application at http://127.0.0.1:8074/.

⁠Pin the exact published image

Use the digest to select the verified publication artifact:

docker pull shellharbor/php-7.4-cve-2026-docker@sha256:aacf3c726d415a96f7694e74f61cd7c6a9ae59aa2bbfe3206daae9ce923300bb

The image was built from repository commit:

086f85ef9a84145204b1ae98974ce1f74a43ceb3

Repository release v1.0.0 identifies this preview. The contained PHP version remains 7.4.33.

⁠Runtime defaults

Provide writable storage at /tmp when using a read-only root filesystem. Temporary uploads and local sessions are ephemeral; persistent application data and shared sessions need suitable storage or external backends.

Configuration and deployment examples are documented in the README⁠.

⁠Validation evidence

Publication checks on 31 October 2026 recorded:

• Successful replay of the complete source patch chain and verification of 139 final source hashes.
• 66 focused PASS records locally and 66 on a clean GitHub hosted build.
• Successful standalone FPM and Nginx Compose checks.
• Successful anonymous pull and PHP execution from the published digest.
• Matching file hashes for five native components against the earlier local runtime.
• Raw Trivy and SBOM evidence collection.

The publication CI run⁠ rebuilt the same source in a clean hosted environment. Its build identity is separate from the published Docker Hub image.

Historical full upstream test results retain 44 FAIL and 1 WARN. Those results belong to an earlier image; focused publication checks do not replace a complete upstream suite. See validation history⁠.

⁠Security and compatibility boundaries

Status remains UNVERIFIED, with production_ready=false.

The recorded publication scan retains 3 CRITICAL and 14 HIGH findings. Applicability assessments do not suppress those findings or waive the production gate. Successful builds and regression checks do not certify the runtime as production-ready.

Important compatibility limits:

• The PHP OpenSSL extension is absent. Native openssl_* functions and PHP TLS/HTTPS stream wrappers are unavailable.
• cURL retains native TLS, but mysqlnd TLS and OpenSSL-dependent authentication remain limited.
• The internal mysqlnd C ABI changed; prebuilt third-party extensions require rebuilding and review.
• Immediate OOM worker termination and disabled session upload progress can affect application behavior.
• Detailed independent mysqlnd review, real application/database interoperability and production deployment validation remain open.

Read the security policy⁠ before evaluating deployment readiness.

⁠Inspect, rebuild and contribute

The GitHub repository⁠ includes Linux and Windows build instructions, source locks, patch provenance, configuration, tests and deployment examples.

For a build problem or compatibility regression, include the image digest, platform, relevant logs and a small reproducer. Remove credentials and private application data before sharing.

PHP and native dependencies retain their upstream notices. See NOTICE.md⁠.