stijans/php repository overview

⁠stijans/php — EOL PHP images with the CVE-2026-109618/109619 fix

On Oct 21 2026 the PHP team disclosed two critical unauthenticated RCEs (CVSS 9.8): CVE-2026-109618 and CVE-2026-109619. Fixed releases exist for PHP 8.2-8.5. For the EOL branches below, the PHP team still published a minimal backport branch — these images are the official alpine-fpm base with that patch applied on top.

docker pull stijans/php:8.0.30-fpm-alpine-cve-2026-109618-109619
docker pull stijans/php:7.4.33-fpm-alpine-cve-2026-109618-109619
docker pull stijans/php:8.1.34-fpm-alpine-cve-2026-109618-109619

Swap in wherever you'd use the matching official alpine-fpm tag — same entrypoint, install-php-extensions works the same on top.

All three PHP versions are EOL. Use these only as a stopgap until you move to a supported PHP version (8.2+). No further updates planned beyond this fix.